CVE-2026-106492: Backstage: Improper preservation of access restrictions during service credential delegation

Description

Backstage is an open framework for building developer portals. Prior to 0.16.1 and 0.17.8, the @backstage/backend-defaults package is affected by improper preservation of access restrictions during service credential delegation. An external service credential configured with access restrictions (e.g., read-only) could bypass those restrictions by routing requests through plugin delegation paths. This could allow a restricted service to perform operations beyond its intended scope, including write operations on plugins it was restricted to read-only access for. This issue is fixed in versions 0.16.1 and 0.17.8.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Attack vector

Network

Complexity

Low

Privileges

Low

User interaction

None

Confidentiality

None

Integrity

High

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.2% · higher than 11% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

BA

backend-defaults · @backstage

< 0.16.1; >= 0.17.0, < 0.17.8 · source: vendor

BA

backstage · backstage

< 1.49.6; >= 1.50.0-next.0, < 1.54.6 · source: vendor, NVD

BA

Backstage/backend-defaults · Linuxfoundation

before 0.16.1; 0.17.0 before 0.17.8 · source: NVD