CVE-2026-125759

Nango before 0.71.3 contains an sql injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL by supplying a crafted task group key to the orchestrator API. Attackers can send a malicious group.key to POST /v1/immediate, which TaskEventsHandler.notify interpolates int...

CVE-2026-125759

Versions of Nango prior to 0.71.3 are vulnerable to an SQL injection vulnerability in the orchestrator API. An unauthenticated attacker can execute arbitrary SQL by sending a crafted group.key to the POST /v1/immediate endpoint. The vulnerability exists because TaskEventsHandler.notify() improper...