CVE-2026-106492
CVE-2026-106492 · Backstage: Improper preservation of access restrictions during service credential delegation
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Backstage is an open framework for building developer portals. Prior to 0.16.1 and 0.17.8, the @backstage/backend-defaults package is affected by improper preservation of access restrictions during service credential delegation. An external service credential configured with access restrictions (e.g., read-only) could bypass those restrictions by routing requests through plugin delegation paths. This could allow a restricted service to perform operations beyond its intended scope, including write operations on plugins it was restricted to read-only access for. This issue is fixed in versions 0.16.1 and 0.17.8.
CVSS 7.6 · High · EPSS 0.2% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
backstage
- Versions
- < 1.49.6: Affected
- >= 1.50.0-next.0, < 1.54.6: Affected
No fix published
backend-defaults
- Versions
- < 0.16.1: Affected
- >= 0.17.0, < 0.17.8: Affected
No fix published
@backstage/backend-defaults npm
- Affected ranges
- SEMVER: < 0.17.8
Update to 0.17.8
Original sources
- https://github.com/backstage/backstage/security/advisories/GHSA-cq7v-rfgc-5c7v
- https://github.com/backstage/backstage/commit/40346245c53e1bf26dee56601e95c5c4ab9cc124
- https://github.com/backstage/backstage/commit/bc80ffdafbc92ff7b8c72347eace13cb8688fd33
- https://github.com/backstage/backstage/releases/tag/v1.49.6
- https://github.com/backstage/backstage/releases/tag/v1.54.6
- https://nvd.nist.gov/vuln/detail/CVE-2026-106492