---
id: "CVE-2026-125759"
page: "https://infrastack.ai/live/CVE-2026-125759"
kind: "vulnerability"
aliases: ["CVE-2026-125759"]
title: "Nango: unauthenticated SQL injection via orchestrator task group key"
severity: "high"
cvss: 7.7
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["nango", "package", "postgres", "self-hosted"]
not_affected_if: ["managed-hosting", "private-network-only"]
published_at: "2026-11-10T16:17:23+00:00"
first_seen_at: "2026-11-10T16:22:35+00:00"
updated_at: "2026-11-10T16:23:27+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-125759", "first_seen_at": "2026-11-10T16:22:35+00:00"}]
exploit_sources: []
---

# Nango: unauthenticated SQL injection via orchestrator task group key

Link for people: https://infrastack.ai/live/CVE-2026-125759 (this .md is for agents)

Nango, an open-source integration platform, interpolates a user-supplied task group key into a Postgres NOTIFY statement in its orchestrator API. An unauthenticated attacker can run stacked SQL queries against the scheduler database.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Nango version with `nango --version` or the deployed image tag; versions before `0.71.3` are affected.
- Confirm whether the orchestrator API endpoint `POST /v1/immediate` is reachable from untrusted networks.

## Fix

- Nango: move to `0.71.3` or later.

## Timeline

- 2026-11-10T16:22:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-125759

## Documents

- [advisory] Vendor advisory: github.com https://github.com/NangoHQ/nango/security/advisories/GHSA-8m28-9wcj-v8ww
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/nango-before-0.71.3-sql-injection-via-orchestrator-task-group-key
- [fix] Patch: github.com https://github.com/NangoHQ/nango/commit/83f24a5a1ed2db59b6d472e49c25333dc6f28709
- [fix] Release notes: github.com https://github.com/NangoHQ/nango/releases/tag/v0.71.3

## From the sources

Nango before 0.71.3 contains an sql injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL by supplying a crafted task group key to the orchestrator API. Attackers can send a malicious group.key to POST /v1/immediate, which TaskEventsHandler.notify() interpolates into a Postgres NOTIFY statement, running stacked queries against the scheduler database.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_