CVE-2026-102596

4.3Medium

Published 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

4.3Medium

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: Limited impact
Weakness: CWE-862

Impact

Authenticated team members with development-only access can read production flow metadata and named flow configurations. Exploitation requires network access and an authenticated account with the development_full_access role on a tenant with RBAC enabled.

Root cause

The GET /api/v1/integrations/:providerConfigKey/flows and GET /api/v1/flow/:flowName endpoints enforce web authentication but omit the required environment-scoped RBAC authorization check.

Affected systems

Nango prior to 0.70.9 (and managed versions prior to managed-1.5.11-0.70.8-aae30d044d7e229807d51a3957c212f3fb689e1a)

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Fix & remediation

Upgrade Nango to 0.70.9 or managed-1.5.11-0.70.8-aae30d044d7e229807d51a3957c212f3fb689e1a. If you cannot upgrade immediately, block external or untrusted access to GET /api/v1/integrations/:providerConfigKey/flows and GET /api/v1/flow/:flowName at your reverse proxy.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Nango is an open-source platform for connecting agents and products to third-party APIs. Prior to 0.70.9, on accounts with RBAC enabled through a plan with has_rbac=true, two private flow-read routes, GET /api/v1/integrations/:providerConfigKey/flows and GET /api/v1/flow/:flowName, apply webAuth but omit can({ action: 'read', resource: 'flow', scopedBy: envScope }). A same-team user with the development_full_access role can therefore request env=prod and read production integration flow metadata or named flow configuration despite being denied by guarded production routes. Both controllers use res.locals.environment from the authenticated account, so the issue bypasses the production role boundary but does not cross tenant boundaries. This issue is fixed in version 0.70.9 and managed-1.5.11-0.70.8-aae30d044d7e229807d51a3957c212f3fb689e1a

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-102596