6 matches found
CVE-2026-125759
Nango before 0.71.3 contains an sql injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL by supplying a crafted task group key to the orchestrator API. Attackers can send a malicious group.key to POST /v1/immediate, which TaskEventsHandler.notify interpolates int...
EUVD-2026-121242
Nango before 0.71.3 contains an sql injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL by supplying a crafted task group key to the orchestrator API. Attackers can send a malicious group.key to POST /v1/immediate, which TaskEventsHandler.notify interpolates int...
CVE-2026-125759
Versions of Nango prior to 0.71.3 are vulnerable to an SQL injection vulnerability in the orchestrator API. An unauthenticated attacker can execute arbitrary SQL by sending a crafted group.key to the POST /v1/immediate endpoint. The vulnerability exists because TaskEventsHandler.notify() improper...
CVE-2026-125759 Nango before 0.71.3 SQL Injection via Orchestrator Task Group Key
Nango before 0.71.3 contains an sql injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL by supplying a crafted task group key to the orchestrator API. Attackers can send a malicious group.key to POST /v1/immediate, which TaskEventsHandler.notify interpolates int...
PT-2026-141755
Nango before 0.71.3 contains an sql injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL by supplying a crafted task group key to the orchestrator API. Attackers can send a malicious group.key to POST /v1/immediate, which TaskEventsHandler.notify interpolates int...
CVE-2026-125759: NangoHQ nango: Nango before 0.71.3 contains an sql injection vulnerability that allows unauthenticated attackers to execute arbitrary…
Nango before 0.71.3 contains an sql injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL by supplying a crafted task group key to the orchestrator API. Attackers can send a malicious group.key to POST /v1/immediate, which TaskEventsHandler.notify interpolates int...