Skip to content
OpenAdvisories

Vendor

NangoHQ

4 known vulnerabilities.

Products

nango 4
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.5
    CVE-2026-125759

    Nango before 0.71.3 SQL Injection via Orchestrator Task Group Key

    Nango before 0.71.3 contains an sql injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL by supplying a crafted task group key to the orchestrator API. Attackers can send a malicious group.key to POST /v1/immediate, which Tas…

    NangoHQ nango
  • High 7.1
    CVE-2026-92804

    Nango through 0.70.4 Server-Side Request Forgery via Configuration

    Nango through 0.70.4 fails to validate caller-supplied connection configuration values interpolated into provider token and proxy URL templates. Authenticated attackers can supply malicious configuration values to direct server requests at internal addresses …

    NangoHQ nango
  • High 8.1
    CVE-2026-9317

    Nango < 0.71.6 Missing Authentication RCE via runner tRPC server

    Nango before 0.71.6 contains a missing authentication vulnerability in the runner tRPC server that allows unauthenticated attackers to execute arbitrary JavaScript code by invoking the exposed start procedure without credentials. Attackers with network access…

    NangoHQ nango