Repository navigation
Security: NangoHQ/nango
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
Unverified Google push notifications are forwarded to customer webhook endpoints with a valid Nango signatureGHSA-42f5-jg2r-v8j7 published
Sep 7, 2026 by rossmcewanModerate -
SSRF in connection post-connection scripts — egress policy not applied in internal-nango (incomplete fix of #6646)GHSA-fqr5-mf8g-p5m2 published
Aug 26, 2026 by rossmcewanHigh -
PagerDuty webhook handler dispatches victim script execution before verifying the signature, so verification never actually gates anythingGHSA-5rjq-rf6r-396x published
Sep 23, 2026 by agusayerzaHigh -
Slack, GitHub App, and Gmail webhook handlers accept forged provider events, triggering sync execution and signed forwarding to customer endpointsGHSA-gqqr-9p2x-78h6 published
Sep 23, 2026 by agusayerzaHigh -
SSRF Guard Bypass via IPv6 Transition Addresses (NAT64/6to4/Teredo) in Egress IP ClassificationGHSA-c6jh-v7p9-556w published
Aug 26, 2026 by rossmcewanHigh -
Nango proxy SSRF via base-url-override header (empty default denylist)GHSA-2j37-g5f6-h55p published
Aug 26, 2026 by rossmcewanHigh -
Unauthenticated SQL injection in the task orchestrator via Postgres NOTIFY (attacker-controlled group key)GHSA-8m28-9wcj-v8ww published
Aug 26, 2026 by rossmcewanHigh -
Production flow RBAC bypass on private flow-read routesGHSA-vc5r-hj76-f35p published
Aug 26, 2026 by rossmcewanModerate -
SSRF via connectionConfig template injection in token and proxy URLsGHSA-hgjm-c252-ccxx published
Aug 26, 2026 by rossmcewanCritical -
Checkr Partner webhooks process events with invalid signaturesGHSA-gmhx-8hfq-8f4x published
Sep 23, 2026 by agusayerzaHigh