CVE-2026-102596: Nango RBAC Authentication Bypass Vulnerability

CVE-2026-102596 Overview

CVE-2026-102596 is a missing authorization vulnerability [CWE-862] in Nango, an open-source platform for connecting agents and products to third-party APIs. On accounts with role-based access control (RBAC) enabled through a plan with has_rbac=true, two private flow-read routes apply webAuth but omit the can({ action: 'read', resource: 'flow', scopedBy: envScope }) check. A same-team user with the development_full_access role can request env=prod and read production integration flow metadata or named flow configuration. The flaw bypasses the production role boundary but does not cross tenant boundaries. Nango fixed the issue in version 0.70.9 and in the managed release managed-1.5.11-0.70.8-aae30d044d7e229807d51a3957c212f3fb689e1a.

Critical Impact
Authenticated users with development-only privileges can read production integration flow metadata and named flow configuration, breaking the production role boundary on RBAC-enabled Nango accounts.

Affected Products

Nango versions prior to 0.70.9
Nango managed releases prior to managed-1.5.11-0.70.8-aae30d044d7e229807d51a3957c212f3fb689e1a
Deployments with RBAC enabled (has_rbac=true)

Discovery Timeline

2026-10-12 - CVE-2026-102596 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-102596

Vulnerability Analysis

The vulnerability affects two private flow-read routes in Nango's server: GET /api/v1/integrations/:providerConfigKey/flows and GET /api/v1/flow/:flowName. Both endpoints enforce the webAuth middleware to confirm an authenticated session but do not apply the can() authorization guard used on comparable production-scoped routes. Both controllers derive the environment context from res.locals.environment populated by the authenticated account. A user holding the development_full_access role can therefore pass env=prod and retrieve production flow data despite being blocked on other production routes.

The issue remains constrained to a single tenant. The authenticated account's team boundary is still honored, so an attacker cannot read flows belonging to another organization. The exposure is limited to intra-tenant privilege escalation from development to production read access on integration flows.

Root Cause

The root cause is a missing authorization check [CWE-862] in packages/server/lib/routes.private.ts. Sibling routes such as /integrations/:providerConfigKey/functions correctly chain webAuth with can({ action: 'read', resource: 'flow', scopedBy: envScope }). The two affected flow routes omitted this can() call, so RBAC was never evaluated against the requested environment scope.

Attack Vector

An authenticated same-team user with development_full_access sends an HTTP request to one of the vulnerable endpoints with the env query parameter set to prod. Because only webAuth runs before the controller, the request reaches the handler, which reads res.locals.environment from the account context and returns production flow metadata or a named flow configuration.

typescript

 web.route('/integrations/:providerConfigKey').get(webAuth, can({ action: 'read', resource: 'integration', scopedBy: envScope }), getIntegration);
 web.route('/integrations/:providerConfigKey').patch(webAuth, can({ action: 'update', resource: 'integration', scopedBy: envScope }), patchIntegration);
 web.route('/integrations/:providerConfigKey').delete(webAuth, can({ action: 'delete', resource: 'integration', scopedBy: envScope }), deleteIntegration);
-web.route('/integrations/:providerConfigKey/flows').get(webAuth, getIntegrationFlows);
+web.route('/integrations/:providerConfigKey/flows').get(webAuth, can({ action: 'read', resource: 'flow', scopedBy: envScope }), getIntegrationFlows);
 web.route('/integrations/:providerConfigKey/functions').get(webAuth, can({ action: 'read', resource: 'flow', scopedBy: envScope }), getIntegrationFunctions);
 web.route('/integrations/:providerConfigKey/functions/:functionName')
     .get(webAuth, can({ action: 'read', resource: 'flow', scopedBy: envScope }), getIntegrationFunction)

Source: GitHub Commit 3896f6ab. The patch inserts the missing can() guard so RBAC is enforced before the flow controller executes.

Detection Methods for CVE-2026-102596

Indicators of Compromise

Requests to GET /api/v1/integrations/:providerConfigKey/flows or GET /api/v1/flow/:flowName containing env=prod from accounts that are not authorized for production.
Audit log entries showing successful production flow reads by users whose role is development_full_access.
Spikes in flow metadata enumeration from a single authenticated session across multiple providerConfigKey values.

Detection Strategies

Correlate HTTP access logs with user role assignments to flag production-scoped responses returned to non-production roles.
Add application-level logging around res.locals.environment to record the resolved environment and the requesting role for each flow route call.
Compare traffic patterns against the sibling /functions routes, which require the can() guard, to identify requests that would have been denied there.

Monitoring Recommendations

Alert on any 2xx response to the two affected endpoints originating from users without a production RBAC role.
Monitor for repeated access to /api/v1/flow/:flowName targeting different flow names within a short interval.
Track upgrades across Nango deployments to confirm all instances reach version 0.70.9 or the fixed managed release.

How to Mitigate CVE-2026-102596

Immediate Actions Required

Upgrade Nango to version 0.70.9 or the managed release managed-1.5.11-0.70.8-aae30d044d7e229807d51a3957c212f3fb689e1a.
Audit RBAC role assignments and remove development_full_access from users who do not require it.
Review audit logs for prior production flow reads performed by non-production roles.

Patch Information

The fix adds the can({ action: 'read', resource: 'flow', scopedBy: envScope }) middleware to both affected routes. Review the GitHub Security Advisory GHSA-vc5r-hj76-f35p, GitHub Pull Request #6603, and the GitHub Release v0.70.9 for release artifacts and verification steps.

Workarounds

Restrict upstream access to the two vulnerable routes via a reverse proxy or API gateway rule until the patch is applied.
Temporarily disable has_rbac=true plans for tenants where production flow confidentiality is critical and apply least-privilege user management instead.
Rotate any secrets referenced in flow configuration that may have been exposed to development-role users prior to patching.

bash

# Upgrade Nango to the fixed version
npm install @nangohq/server@0.70.9

# Verify the installed version
npm list @nangohq/server | grep 0.70.9