Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-102596— Nango: Production flow RBAC bypass on private flow-read routes

Quick assessment

Affected
NangoHQ nango
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Nango 是一个用于将智能体（agents）和产品连接至第三方 API 的开源平台。在 0.70.9 版本之前，对于启用了基于角色的访问控制（RBAC）且计划配置中 的账户，存在两个私有的“读取流程”API 路由： 和 。这些路由虽然实施了 WebAuth 认证，但缺少对权限 的校验。 因此，即使受保护的生产环境路由已禁止访问，拥有 （完全开发访问）角色的同团队用户仍可通过指定 参数，读取生产环境中的集成流程元数据或命名流程配置。由于这两个控制器均使用通过认证账户的 来确定环境范围，该漏洞绕过了生产环境角色边界，

CVSS 4.3 · Medium

Possible ATT&CK Techniques 1 AI

T1078.004 · Cloud Accounts
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-102596

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Nango: Production flow RBAC bypass on private flow-read routes
Source: CVE Program / CVE List V5
Vulnerability Description
Nango is an open-source platform for connecting agents and products to third-party APIs. Prior to 0.70.9, on accounts with RBAC enabled through a plan with has_rbac=true, two private flow-read routes, GET /api/v1/integrations/:providerConfigKey/flows and GET /api/v1/flow/:flowName, apply webAuth but omit can({ action: 'read', resource: 'flow', scopedBy: envScope }). A same-team user with the development_full_access role can therefore request env=prod and read production integration flow metadata or named flow configuration despite being denied by guarded production routes. Both controllers use res.locals.environment from the authenticated account, so the issue bypasses the production role boundary but does not cross tenant boundaries. This issue is fixed in version 0.70.9 and managed-1.5.11-0.70.8-aae30d044d7e229807d51a3957c212f3fb689e1a
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
NangoHQ nango < 0.70.9 -

II. Public POCs for CVE-2026-102596

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-102596

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-102596 (2)

Vendor Advisories for CVE-2026-102596 (1)

Vendor Pages for CVE-2026-102596 (2)

IV. Related Vulnerabilities

Same product: nango
Same vendor: NangoHQ
Same weakness: CWE-862

V. Comments for CVE-2026-102596

No comments yet

Leave a comment