CVE-2026-102596: Nango: Production flow RBAC bypass on private flow-read routes
Nango is an open-source platform for connecting agents and products to third-party APIs. Prior to 0.70.9, on accounts with RBAC enabled through a plan with hasrbac=true, two private flow-read routes, GET /api/v1/integrations/:providerConfigKey/flows and GET /api/v1/flow/:flowName, apply webAuth but omit can({ action: 'read', resource: 'flow', scopedBy: envScope }). A same-team user with the developmentfullaccess role can therefore request env=prod and read production integration flow metadata or named flow configuration despite being denied by guarded production routes. Both controllers use res.locals.environment from the authenticated account, so the issue bypasses the production role boundary but does not cross tenant boundaries. This issue is fixed in version 0.70.9 and managed-1.5.11-0.70.8-aae30d044d7e229807d51a3957c212f3fb689e1a
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Nangoto a version that resolves this vulnerability.Fixed in 0.70.9 - Upgrade
Upgrade
Nango managedto a version that resolves this vulnerability.Fixed in 1.5.11-0.70.8-aae30d044d7e229807d51a3957c212f3fb689e1a
Event History
Frequently Asked Questions
Which users can exploit this issue?
A same-team user assigned the development_full_access role can exploit it when RBAC is enabled for the account through a plan with has_rbac=true. The issue does not allow access across tenant boundaries.
What access can an attacker obtain?
The affected user can request the production environment and read production integration flow metadata or named flow configuration through the two affected private read routes. The available data does not indicate modification or deletion capability.
Are all Nango deployments affected?
No. The described exposure requires RBAC to be enabled through a plan with has_rbac=true and a user with the development_full_access role. Versions prior to 0.70.9 are affected.
How can I determine whether my deployment is exposed?
Check whether the deployment runs a version before 0.70.9, has RBAC enabled via has_rbac=true, and includes same-team development_full_access users who should be prevented from reading production flows. Review requests to GET /api/v1/integrations/:providerConfigKey/flows and GET /api/v1/flow/:flowName that specify env=prod.
What version fixes the issue?
Upgrade to Nango 0.70.9 or managed-1.5.11-0.70.8-aae30d044d7e229807d51a3957c212f3fb689e1a.