Skip to content
Threat Feed
Subscribe
high advisory

Nango: Unauthenticated SQL injection in orchestrator API (CVE-2026-125759)

Nango versions before 0.71.3 are vulnerable to an unauthenticated SQL injection allowing arbitrary query execution via the orchestrator API.

CVE search metadata

CVE search record: CVE-2026-125759. Severity: high. CVSS: 7.5. KEV: no. Product: Nango (< 0.71.3). Brief: Nango: Unauthenticated SQL injection in orchestrator API (CVE-2026-125759). Brief link: https://feed.craftedsignal.io/briefs/2026-11-nango-sql-injection/

Triage facts

Revision 1
Applicability
Nango (< 0.71.3)
Evidence
Unknown
Severity
High
Action
Elevated
Sources
1 public source
Freshness
Revision 1Nov 10, 18:28 UTC
Detection
1 rule
Vulnerabilities
1 CVE
Source quality
A1Likely

Nango versions prior to 0.71.3 contain an SQL injection vulnerability in the orchestrator API. An unauthenticated attacker can exploit this by submitting a crafted 'group.key' parameter to the 'POST /v1/immediate' endpoint. The 'TaskEventsHandler.notify()' function improperly interpolates this input into a PostgreSQL 'NOTIFY' statement, enabling the execution of arbitrary stacked SQL queries against the scheduler database.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary SQL commands against the Nango scheduler database, potentially leading to unauthorized data access or database modification.

Recommendation

  • Upgrade Nango to version 0.71.3 or later to remediate the vulnerability in 'TaskEventsHandler.notify()'.
  • Audit logs for 'POST' requests to '/v1/immediate' where the 'group.key' parameter contains suspicious SQL characters or patterns.

Immediate actions

Patch Nango instances to version 0.71.3 or later.

IT Operations 48h

Deploy Sigma rules and monitor for potential exploitation attempts.

SOC 24h

Threat Hunt

Inspect web server logs for high volume of POST /v1/immediate requests from single IPs or presence of SQL syntax in query parameters.

T1190 high medium confidence hunt now

Data: web server access logs

Mitigations

Upgrade Nango to 0.71.3 or later.

immediate IT Operations

CVE-2026-125759

Detection coverage 1

Detects CVE-2026-125759 Exploitation - SQL injection in /v1/immediate

high

Detects exploitation of CVE-2026-125759 by identifying POST requests to the /v1/immediate endpoint with suspicious SQL meta-characters in the group.key parameter.

sigma tactics: execution, initial_access techniques: T1190 sources: webserver

Detection queries are available on the platform. Get full rules →