CVE-2026-125759

Name of the Vulnerable Software and Affected Versions Nango versions prior to 0.71.3

Description Unauthenticated attackers can execute arbitrary SQL by providing a crafted task group key to the orchestrator API. By sending a malicious group.key to the 'POST /v1/immediate' endpoint, the TaskEventsHandler.notify() function interpolates the input into a Postgres NOTIFY statement, enabling the execution of stacked queries against the scheduler database.

Recommendations Update Nango to version 0.71.3 or later. As a temporary mitigation, restrict access to the 'POST /v1/immediate' endpoint or avoid using the group.key parameter until the update is applied.