# CVE-2026-125759: Nango orchestrator SQL injection via task group key

Source: https://junglewise.ai/threats/cve-2026-125759-nango-before-0-71-3-contains-an-sql-injection-vulnerability-that  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-10. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-125759 · Severity: high · CVSS 7.5 · Published 2026-11-10

Nango is an integration platform that orchestrates API connections and tasks. An unauthenticated attacker can inject malicious SQL by sending a crafted task group key to the orchestrator API, allowing them to execute arbitrary database queries and potentially steal or modify data in the scheduler database.

Technologies: [Nango](https://junglewise.ai/threats/technologies/nango). Vendors: [Nango](https://junglewise.ai/threats/vendors/nango).

## Quick answers

**Is CVE-2026-125759 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-125759 being exploited in the wild.

**How severe is CVE-2026-125759?** High severity, with a CVSS score of 7.5, published 10 November 2026.

**Which products and versions are affected?** Nango before 0.71.3.

**Is there a fix for CVE-2026-125759?** Yes: fixed in 0.71.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-125759 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-125759?** Check whether you run Nango at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 0.71.3

## Technical details

The vulnerability is a SQL injection in the TaskEventsHandler.notify() method of Nango's orchestrator, where the group.key parameter is directly interpolated into a PostgreSQL NOTIFY statement sent via POST /v1/immediate without parameterization. By supplying a malicious group key, an attacker can execute stacked queries against the scheduler database using the client.query() call with string concatenation. The fix uses parameterized queries (pg_notify with bound parameters) to prevent injection.

## Affected products

- Nango Nango before 0.71.3

## Timeline

- 2026-11-10: disclosed
- 2026-11-10: patched

## References

- [https://github.com/NangoHQ/nango/blob/v0.71.1/packages/orchestrator/lib/events.ts](https://github.com/NangoHQ/nango/blob/v0.71.1/packages/orchestrator/lib/events.ts)
- [https://github.com/NangoHQ/nango/commit/83f24a5a1ed2db59b6d472e49c25333dc6f28709](https://github.com/NangoHQ/nango/commit/83f24a5a1ed2db59b6d472e49c25333dc6f28709)

## Related threats

- [Nango RBAC bypass on flow read routes](https://junglewise.ai/threats/cve-2026-102596-nango-is-an-open-source-platform-for-connecting-agents-and)
- [Nango connection configuration SSRF in URL templates](https://junglewise.ai/threats/cve-2026-92804-nango-connection-configuration-ssrf-in-url-templates)
- [Nango missing authentication in runner tRPC server](https://junglewise.ai/threats/cve-2026-9317-nango-missing-authentication-in-runner-trpc-server)