Nango vulnerabilities

3 known vulnerabilities in Nango from NangoHQ. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  nango: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2026-125759Nov 10, 2026NangoHQ

  Nango before 0.71.3 contains an sql injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL by supplying a crafted task group key to the orchestrator API. Attackers can send a malicious group.key to POST /v1/immediate, which Task

• 7.1 High severity

  Nango: Server-Side Request Forgery

  CVE-2026-92804Sep 16, 2026NangoHQ

  Nango through 0.70.4 fails to validate caller-supplied connection configuration values interpolated into provider token and proxy URL templates. Authenticated attackers can supply malicious configuration values to direct server requests at internal addresses o

• 8.1 High severity

  nango: Missing Authentication for Critical Functionality

  CVE-2026-9317Sep 4, 2026NangoHQEPSS 1.26%

  Nango before 0.71.6 contains a missing authentication vulnerability in the runner tRPC server that allows unauthenticated attackers to execute arbitrary JavaScript code by invoking the exposed start procedure without credentials. Attackers with network access