NangoHQ vulnerabilities
We track 3 vulnerabilities in NangoHQ products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on November 10, 2026.
Latest NangoHQ vulnerabilities
- 7.5 High severity
nango: Improper Neutralization of Special Elements used in an SQL Command
Nango before 0.71.3 contains an sql injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL by supplying a crafted task group key to the orchestrator API. Attackers can send a malicious group.key to POST /v1/immediate, which Task
- 7.1 High severity
Nango: Server-Side Request Forgery
Nango through 0.70.4 fails to validate caller-supplied connection configuration values interpolated into provider token and proxy URL templates. Authenticated attackers can supply malicious configuration values to direct server requests at internal addresses o
- 8.1 High severity
nango: Missing Authentication for Critical Functionality
Nango before 0.71.6 contains a missing authentication vulnerability in the runner tRPC server that allows unauthenticated attackers to execute arbitrary JavaScript code by invoking the exposed start procedure without credentials. Attackers with network access