p PatchFirst

CVE-2026-106492

CVE-2026-106492 · Backstage: Improper preservation of access restrictions during service credential delegation

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

Backstage is an open framework for building developer portals. Prior to 0.16.1 and 0.17.8, the @backstage/backend-defaults package is affected by improper preservation of access restrictions during service credential delegation. An external service credential configured with access restrictions (e.g., read-only) could bypass those restrictions by routing requests through plugin delegation paths. This could allow a restricted service to perform operations beyond its intended scope, including write operations on plugins it was restricted to read-only access for. This issue is fixed in versions 0.16.1 and 0.17.8.

CVSS 7.6 · Alta · EPSS 0,2% · Corrección disponible

Publicación
Actualización

Pila tecnológica: node

Productos y versiones afectados

  • backstage

    Versiones
    • < 1.49.6: Afectada
    • >= 1.50.0-next.0, < 1.54.6: Afectada

    Sin corrección publicada

  • backend-defaults

    Versiones
    • < 0.16.1: Afectada
    • >= 0.17.0, < 0.17.8: Afectada

    Sin corrección publicada

  • @backstage/backend-defaults npm

    Intervalos de versiones afectados
    • SEMVER: < 0.17.8

    Actualiza a 0.17.8

Fuentes originales

Comprueba tu servidor →