CVE-2026-125759 | BDVDB-2026-402997 Detail
NangoHQnango
Description#
Nango before 0.71.3 contains an sql injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL by supplying a crafted task group key to the orchestrator API. Attackers can send a malicious group.key to POST /v1/immediate, which TaskEventsHandler.notify() interpolates into a Postgres NOTIFY statement, running stacked queries against the scheduler database.
Impact#
Per CVSS v3.1: confidentiality impact high, integrity impact high, availability impact high. Attack vector: network.
Weaknesses#
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
References#
- https://github.com/NangoHQ/nango/security/advisories/GHSA-8m28-9wcj-v8ww
- https://github.com/NangoHQ/nango/commit/83f24a5a1ed2db59b6d472e49c25333dc6f28709
- https://github.com/NangoHQ/nango/pull/6867
- https://github.com/NangoHQ/nango/releases/tag/v0.71.3
- https://github.com/NangoHQ/nango/blob/v0.71.1/packages/orchestrator/lib/events.ts#L162
- https://www.vulncheck.com/advisories/nango-before-0.71.3-sql-injection-via-orchestrator-task-group-key
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.