Nango (< 0.71.3) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/nango--0.71.3/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 10 Nov 2026 18:28:06 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgNango: Unauthenticated SQL injection in orchestrator API (CVE-2026-125759)https://feed.craftedsignal.io/briefs/2026-11-nango-sql-injection/Tue, 10 Nov 2026 18:28:06 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-nango-sql-injection/Nango versions before 0.71.3 are vulnerable to an unauthenticated SQL injection allowing arbitrary query execution via the orchestrator API.Nango versions prior to 0.71.3 contain an SQL injection vulnerability in the orchestrator API. An unauthenticated attacker can exploit this by submitting a crafted 'group.key' parameter to the 'POST /v1/immediate' endpoint. The 'TaskEventsHandler.notify()' function improperly interpolates this input into a PostgreSQL 'NOTIFY' statement, enabling the execution of arbitrary stacked SQL queries against the scheduler database.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary SQL commands against the Nango scheduler database, potentially leading to unauthorized data access or database modification.

Recommendation

  • Upgrade Nango to version 0.71.3 or later to remediate the vulnerability in 'TaskEventsHandler.notify()'.
  • Audit logs for 'POST' requests to '/v1/immediate' where the 'group.key' parameter contains suspicious SQL characters or patterns.
]]>highadvisory