CVE-2026-125759 | NangoHQ Nango up to 0.71.2 Orchestrator /v1/immediate TaskEventsHandler.notify group.key sql injection

November 10, 2026 Yanac

A vulnerability classified as critical has been found in NangoHQ Nango up to 0.71.2. This issue affects the function TaskEventsHandler.notify of the file /v1/immediate of the component Orchestrator. This manipulation of the argument group.key causes sql injection.

The identification of this vulnerability is CVE-2026-125759. It is possible to initiate the attack remotely. There is no exploit available.

It is recommended to upgrade the affected component.VulDB Recent EntriesRead More