CVE-2026-125759— Nango before 0.71.3 SQL Injection via Orchestrator Task Group Key
Quick assessment
Affected
NangoHQ nango
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Nango 在 0.71.3 版本之前存在 SQL 注入漏洞，允许未认证的攻击者通过向编排器（orchestrator）API 提供精心构造的任务组密钥（task group key）来执行任意 SQL 语句。攻击者可向 接口发送恶意的 ，该参数会被 方法拼接到 PostgreSQL 的 语句中，从而在调度器数据库上执行堆叠查询。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-125759
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Nango before 0.71.3 SQL Injection via Orchestrator Task Group Key
Source: CVE Program / CVE List V5
Vulnerability Description
Nango before 0.71.3 contains an sql injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL by supplying a crafted task group key to the orchestrator API. Attackers can send a malicious group.key to POST /v1/immediate, which TaskEventsHandler.notify() interpolates into a Postgres NOTIFY statement, running stacked queries against the scheduler database.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-125759
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-125759
请登录查看更多情报信息。
Other References for CVE-2026-125759 (6)
-
https://github.com/NangoHQ/nango/blob/v0.71.1/packages/orchestrator/lib/events.ts#L162 technical-description
-
-
https://github.com/NangoHQ/nango/releases/tag/v0.71.3 release-notes