SQL Injection Vulnerability in Nango Orchestrator API by NangoHQ
CVE-2026-125759

7.7HIGH

Key Information:

Vendor

Nangohq

Status
Nango
Vendor
CVE Published:
10 November 2026

What is CVE-2026-125759?

The Nango software before version 0.71.3 is exposed to an SQL injection vulnerability that enables unauthenticated attackers to execute arbitrary SQL commands by leveraging a malicious task group key sent to the orchestrator API. Specifically, by posting a crafted group.key to the /v1/immediate endpoint, attackers can manipulate the SQL statements executed on the scheduler database, potentially leading to unauthorized access and data manipulation.

Affected Version(s)

nango 0 < 0.71.3

References

https://github.com/NangoHQ/nango/security/advisories/GHSA...
vendor-advisory
https://github.com/NangoHQ/nango/commit/83f24a5a1ed2db59b...
patch
https://github.com/NangoHQ/nango/pull/6867
issue-trackingpatch

CVSS V4

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

GrayOM
.