CVE-2026-125759
HIGH
NVD
CVSS Score
7.5
Severity
HIGH
Published
Nov 10, 2026
Vendor
unknown
Description
Nango before 0.71.3 contains an sql injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL by supplying a crafted task group key to the orchestrator API. Attackers can send a malicious group.key to POST /v1/immediate, which TaskEventsHandler.notify() interpolates into a Postgres NOTIFY statement, running stacked queries against the scheduler database.
References
- https://github.com/NangoHQ/nango/blob/v0.71.1/packages/orchestrator/lib/events.ts#L162
- https://github.com/NangoHQ/nango/commit/83f24a5a1ed2db59b6d472e49c25333dc6f28709
- https://github.com/NangoHQ/nango/pull/6867
- https://github.com/NangoHQ/nango/releases/tag/v0.71.3
- https://github.com/NangoHQ/nango/security/advisories/GHSA-8m28-9wcj-v8ww