{"id":"CVE-2026-125759","kind":"vulnerability","aliases":["CVE-2026-125759"],"related":[],"title":"Nango: unauthenticated SQL injection via orchestrator task group key","description":"Nango before 0.71.3 contains an sql injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL by supplying a crafted task group key to the orchestrator API. Attackers can send a malicious group.key to POST /v1/immediate, which TaskEventsHandler.notify() interpolates into a Postgres NOTIFY statement, running stacked queries against the scheduler database.","summary":"Nango, an open-source integration platform, interpolates a user-supplied task group key into a Postgres NOTIFY statement in its orchestrator API. An unauthenticated attacker can run stacked SQL queries against the scheduler database.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["nango","package","postgres","self-hosted"],"not_affected_if":["managed-hosting","private-network-only"],"how_to_check":"- Check the Nango version with `nango --version` or the deployed image tag; versions before `0.71.3` are affected.\n- Confirm whether the orchestrator API endpoint `POST /v1/immediate` is reachable from untrusted networks.","fix":"- Nango: move to `0.71.3` or later.","status":"open","published_at":"2026-11-10T16:17:23+00:00","first_seen_at":"2026-11-10T16:22:35+00:00","triaged_at":"2026-11-10T16:23:27+00:00","updated_at":"2026-11-10T16:23:27+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-10T16:23:27Z","model":"claude-haiku-5-5","output":{"fix":"- Nango: move to `0.71.3` or later.","reach":"internet","title":"Nango: unauthenticated SQL injection via orchestrator task group key","impact":"high","summary":"Nango, an open-source integration platform, interpolates a user-supplied task group key into a Postgres NOTIFY statement in its orchestrator API. An unauthenticated attacker can run stacked SQL queries against the scheduler database.","audience":"businesses","category":"package","nicknames":[],"who_cares":["nango","self-hosted","postgres"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker runs arbitrary SQL against the scheduler database.","analyst_note":"","how_to_check":"- Check the Nango version with `nango --version` or the deployed image tag; versions before `0.71.3` are affected.\n- Confirm whether the orchestrator API endpoint `POST /v1/immediate` is reachable from untrusted networks.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["managed-hosting","private-network-only"],"who_is_affected":"Teams that self-host Nango with its orchestrator API exposed to networks the attacker can reach, where the scheduler database is Postgres. Managed hosting or deployments that keep the orchestrator API private are less exposed; the sources do not say which deployments are exposed by default.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000723,"input_tokens":4657,"output_tokens":515,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-125759':12A,15A '-2026':11A,14A '/v1/immediate':93C '0.71.3':60C 'allow':67C 'api':45B,84C 'arbitrari':72C 'attack':48B,69C,85C 'contain':61C 'craft':77C 'cve':10A,13A 'databas':57B,108C 'execut':71C 'group':8A,35B,79C 'group.key':90C 'host':21B 'inject':4A,64C 'integr':27B 'interpol':29B,96C 'key':9A,36B,80C 'malici':89C 'nango':1A,16B,22B,58C 'notifi':40B,100C 'open':25B 'open-sourc':24B 'orchestr':6A,44B,83C 'packag':17B 'platform':28B 'post':92C 'postgr':18B,39B,99C 'queri':53B,104C 'run':50B,102C 'schedul':56B,107C 'self':20B 'self-host':19B 'send':87C 'sourc':26B 'sql':3A,52B,63C,73C 'stack':51B,103C 'statement':41B,101C 'suppli':33B,75C 'task':7A,34B,78C 'taskeventshandler.notify':95C 'unauthent':2A,47B,68C 'user':32B 'user-suppli':31B 'via':5A 'vulner':65C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host Nango with its orchestrator API exposed to networks the attacker can reach, where the scheduler database is Postgres. Managed hosting or deployments that keep the orchestrator API private are less exposed; the sources do not say which deployments are exposed by default.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","nango","package","postgres","selfhosted"],"campaign_type":null,"search_a":"'-125759':12A,15A '-2026':11A,14A 'cve':10A,13A 'group':8A 'inject':4A 'key':9A 'nango':1A 'orchestr':6A 'sql':3A 'task':7A 'unauthent':2A 'via':5A","search_b":"'api':45B 'attack':48B 'databas':57B 'group':35B 'host':21B 'integr':27B 'interpol':29B 'key':36B 'nango':16B,22B 'notifi':40B 'open':25B 'open-sourc':24B 'orchestr':44B 'packag':17B 'platform':28B 'postgr':18B,39B 'queri':53B 'run':50B 'schedul':56B 'self':20B 'self-host':19B 'sourc':26B 'sql':52B 'stack':51B 'statement':41B 'suppli':33B 'task':34B 'unauthent':47B 'user':32B 'user-suppli':31B","search_c":"'/v1/immediate':93C '0.71.3':60C 'allow':67C 'api':84C 'arbitrari':72C 'attack':69C,85C 'contain':61C 'craft':77C 'databas':108C 'execut':71C 'group':79C 'group.key':90C 'inject':64C 'interpol':96C 'key':80C 'malici':89C 'nango':58C 'notifi':100C 'orchestr':83C 'post':92C 'postgr':99C 'queri':104C 'run':102C 'schedul':107C 'send':87C 'sql':63C,73C 'stack':103C 'statement':101C 'suppli':75C 'task':78C 'taskeventshandler.notify':95C 'unauthent':68C 'vulner':65C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-08-26T11:54:25+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125759","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125759","severity":null,"published_at":"2026-11-10T16:17:23+00:00","modified_at":"2026-11-10T16:17:23+00:00","first_seen_at":"2026-11-10T16:22:35+00:00","fetched_at":"2026-11-10T16:22:35+00:00","note":null}],"documents":[{"id":116143,"url":"https://github.com/NangoHQ/nango/commit/83f24a5a1ed2db59b6d472e49c25333dc6f28709","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":116144,"url":"https://github.com/NangoHQ/nango/releases/tag/v0.71.3","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":116145,"url":"https://github.com/NangoHQ/nango/security/advisories/GHSA-8m28-9wcj-v8ww","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-08-26T11:54:25+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":116146,"url":"https://www.vulncheck.com/advisories/nango-before-0.71.3-sql-injection-via-orchestrator-task-group-key","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}