NangoHQ has 3 CVEs on record. 3 were published in the last 90 days. The median CVSS is 7.1 (high).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.1
- Publish → KEV
- —
- Last 90 days
- 3 prev 0
Worst active — by depth score
CVE-2026-9317High· 8.1Nango before 0.71.6 contains a missing authentication vulnerability in the runner tRPC server that allows unauthenticated attackers to execute arbitrary JavaScript code by invoking the exposed start procedure without credentials45CVE-2026-92804High· 7.1Nango through 0.70.4 fails to validate caller-supplied connection configuration values interpolated into provider token and proxy URL templates39CVE-2026-102596Medium· 4.3Nango is an open-source platform for connecting agents and products to third-party APIs36
NangoHQ vulnerabilities
CVEs affecting NangoHQ, newest first. Open any entry for full detail, references, and exploit status.
3 CVEsRSS
CVE-2026-102596Medium· 4.3PoCNango is an open-source platform for connecting agents and products to third-party APIs
Nango is an open-source platform for connecting agents and products to third-party APIs. Prior to 0.70.9, on accounts with RBAC enabled through a plan with has_rbac=true, two private flow-read routes, GET /api/v1/integrations/:providerCo…
CVE-2026-92804High· 7.1Nango through 0.70.4 fails to validate caller-supplied connection configuration values interpolated into provider token and proxy URL templates
Nango through 0.70.4 fails to validate caller-supplied connection configuration values interpolated into provider token and proxy URL templates. Authenticated attackers can supply malicious configuration values to direct server requests …
CVE-2026-9317High· 8.1Nango before 0.71.6 contains a missing authentication vulnerability in the runner tRPC server that allows unauthenticated attackers to execute arbitrary JavaScript code by invoking the exposed start procedure without credentials
Nango before 0.71.6 contains a missing authentication vulnerability in the runner tRPC server that allows unauthenticated attackers to execute arbitrary JavaScript code by invoking the exposed start procedure without credentials. Attacke…