CVE-2026-125759: Nango before 0.71.3 SQL Injection via Orchestrator Task Group Key

Published Nov 10, 2026

Updated

Nango before 0.71.3 contains an sql injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL by supplying a crafted task group key to the orchestrator API. Attackers can send a malicious group.key to POST /v1/immediate, which TaskEventsHandler.notify() interpolates into a Postgres NOTIFY statement, running stacked queries against the scheduler database.

Event History

Nov 10, 2026

CVE Published

via MITRE·03:22 PM

Data Sourced

via MITRE·03:22 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Does an attacker need an account or prior authentication to exploit this issue?

No. The vulnerability is described as exploitable by unauthenticated attackers through the orchestrator API.

What endpoint and input are involved in exploitation?

An attacker sends a crafted group.key value to POST /v1/immediate. The value reaches TaskEventsHandler.notify(), where it is interpolated into a PostgreSQL NOTIFY statement.

Which deployments need remediation?

Nango versions before 0.71.3 are affected. Upgrade to version 0.71.3 or later.

CVE-2026-125759: Nango before 0.71.3 SQL Injection via Orchestrator Task Group Key

Event History

Frequently Asked Questions

Does an attacker need an account or prior authentication to exploit this issue?

What endpoint and input are involved in exploitation?

Which deployments need remediation?

Company

Resources

Contact

Frequently Asked Questions

Does an attacker need an account or prior authentication to exploit this issue?

What endpoint and input are involved in exploitation?

Which deployments need remediation?