{"id":"CVE-2026-125759","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-125759","summary":"Nango before 0.71.3 contains an sql injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL by supplying a crafted task group key to the orchestrator…","details":"Nango before 0.71.3 contains an sql injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL by supplying a crafted task group key to the orchestrator API. Attackers can send a malicious group.key to POST /v1/immediate, which TaskEventsHandler.notify() interpolates into a Postgres NOTIFY statement, running stacked queries against the scheduler database.","published":"2026-11-10T16:17:23.430","modified":"2026-11-10T16:17:23.570","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":{"url":"https://github.com/NangoHQ/nango/commit/83f24a5a1ed2db59b6d472e49c25333dc6f28709","label":"NangoHQ/nango@83f24a5"},"references":[{"type":"WEB","url":"https://github.com/NangoHQ/nango/blob/v0.71.1/packages/orchestrator/lib/events.ts#L162"},{"type":"WEB","url":"https://github.com/NangoHQ/nango/commit/83f24a5a1ed2db59b6d472e49c25333dc6f28709"},{"type":"WEB","url":"https://github.com/NangoHQ/nango/pull/6867"},{"type":"WEB","url":"https://github.com/NangoHQ/nango/releases/tag/v0.71.3"},{"type":"WEB","url":"https://github.com/NangoHQ/nango/security/advisories/GHSA-8m28-9wcj-v8ww"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/nango-before-0.71.3-sql-injection-via-orchestrator-task-group-key"}],"provenance":{"sources":["OSV.dev","NVD","FIRST.org (EPSS)"],"lastVerified":"2026-11-10T16:17:23.570"}}