CVE-2026-125759 Nango before 0.71.3 SQL Injection via Orchestrator Task Group Key

High 7.7 Published 10 Nov 2026 Updated 10 Nov 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-125759?

CVE-2026-125759 is a high-severity vulnerability in NangoHQ nango, published on 10 Nov 2026.

Official description

Nango before 0.71.3 contains an sql injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL by supplying a crafted task group key to the orchestrator API. Attackers can send a malicious group.key to POST /v1/immediate, which TaskEventsHandler.notify() interpolates into a Postgres NOTIFY statement, running stacked queries against the scheduler database.

Weakness: CWE-89

Which versions are affected by CVE-2026-125759?

How do I fix CVE-2026-125759?

No fix has been published for CVE-2026-125759 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-125759 being exploited?

There is no known exploitation of CVE-2026-125759 in the wild and no public exploit code.

Sources

Also known as GHSA-3w4f-3q27-257j, GHSA-8m28-9wcj-v8ww.