CVE-2026-102596Published
Nango: Production flow RBAC bypass on private flow-read routes
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-102596 · Microsoft / collected KEV context
cve-program · CVE-2026-102596
- https://github.com/NangoHQ/nango/security/advisories/GHSA-vc5r-hj76-f35p
- https://github.com/NangoHQ/nango/pull/6603
- https://github.com/NangoHQ/nango/commit/3896f6abf71408b8966da1ea4afb1885647403c9
- https://github.com/NangoHQ/nango/releases/tag/managed-1.5.11-0.70.8-aae30d044d7e229807d51a3957c212f3fb689e1a
- https://github.com/NangoHQ/nango/releases/tag/v0.70.9
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.