Sensitive Data Exposure in Nango API by NangoHQ

CVE-2026-102596

What is CVE-2026-102596?

Nango, an open-source API connection platform, experienced an access control vulnerability that affects accounts with Role-Based Access Control (RBAC) enabled. Before version 0.70.9, two private flow-read routes were found to improperly apply web authentication, allowing users with development_full_access roles to access production integration flow metadata. This flaw bypasses the expected production role boundaries, exposing sensitive configuration details. Nango has addressed this issue in subsequent releases, particularly in versions 0.70.9 and managed-1.5.11-0.70.8-aae30d044d7e229807d51a3957c212f3fb689e1a.

References