CVE-2026-102596

Deferred Deferred - Pending Action

Authentication Bypass in Nango via RBAC Misconfiguration

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: GitHub, Inc.

Description

Nango is an open-source platform for connecting agents and products to third-party APIs. Prior to 0.70.9, on accounts with RBAC enabled through a plan with has_rbac=true, two private flow-read routes, GET /api/v1/integrations/:providerConfigKey/flows and GET /api/v1/flow/:flowName, apply webAuth but omit can({ action: 'read', resource: 'flow', scopedBy: envScope }). A same-team user with the development_full_access role can therefore request env=prod and read production integration flow metadata or named flow configuration despite being denied by guarded production routes. Both controllers use res.locals.environment from the authenticated account, so the issue bypasses the production role boundary but does not cross tenant boundaries. This issue is fixed in version 0.70.9 and managed-1.5.11-0.70.8-aae30d044d7e229807d51a3957c212f3fb689e1a

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2026-102596

Affected Vendors & Products

Vendor	Product	Version / Range
NangoHQ	nango	< 0.70.9

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability affects Nango, an open-source platform for API connections. When RBAC is enabled, two private routes for reading flow metadata do not properly enforce read permissions for production environments. A user with development_full_access role can bypass production role boundaries and read sensitive flow configuration by manipulating environment parameters.

Detection Guidance

To detect this vulnerability, check if your Nango instance is running a version prior to 0.70.9. Verify RBAC settings and review access logs for unauthorized requests to GET /api/v1/integrations/:providerConfigKey/flows or GET /api/v1/flow/:flowName with env=prod. Ensure production flows are not accessible by development_full_access roles.

Impact Analysis

If you use Nango with RBAC enabled, an attacker with a developer role could access production flow metadata or configurations they shouldn't. This could expose sensitive API integration details, workflow logic, or other internal configurations, potentially leading to further security issues or data leaks.

Compliance Impact

This vulnerability could impact compliance by exposing sensitive data or configurations that may contain personal or protected health information. Unauthorized access to production flows might violate data protection requirements under GDPR or HIPAA, depending on the data processed by the affected integrations.

Mitigation Strategies

Immediately upgrade Nango to version 0.70.9 or later to address the RBAC bypass in flow-read routes. Verify the deployment of the managed-1.5.11-0.70.8-aae30d044d7e229807d51a3957c212f3fb689e1a patch if using managed instances.

Hi! I’m here to help you understand CVE-2026-102596. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70