CVE-2026-125759 · Package
NO FIX YET · SEE WHAT TO DO
Nango, an open-source integration platform, interpolates a user-supplied task group key into a Postgres NOTIFY statement in its orchestrator API. An unauthenticated attacker can run stacked SQL queries against the scheduler database.
first public Aug 26, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams that self-host Nango with its orchestrator API exposed to networks the attacker can reach, where the scheduler database is Postgres. Managed hosting or deployments that keep the orchestrator API private are less exposed; the sources do not say which deployments are exposed by default.
Not affected if managed-hosting, private-network-only
Who cares nango, postgres, self-hosted
nango --version or the deployed image tag; versions before 0.71.3 are affected.POST /v1/immediate is reachable from untrusted networks.0.71.3 or later.Nango before 0.71.3 contains an sql injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL by supplying a crafted task group key to the orchestrator API. Attackers can send a malicious group.key to POST /v1/immediate, which TaskEventsHandler.notify() interpolates into a Postgres NOTIFY statement, running stacked queries against the scheduler database.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.