{"id":"CVE-2026-106492","aliases":["EUVD-2026-94012","GHSA-cq7v-rfgc-5c7v"],"status":"published","title":"Backstage: Improper preservation of access restrictions during service credential delegation","description":"Backstage is an open framework for building developer portals. Prior to 0.16.1 and 0.17.8, the @backstage/backend-defaults package is affected by improper preservation of access restrictions during service credential delegation. An external service credential configured with access restrictions (e.g., read-only) could bypass those restrictions by routing requests through plugin delegation paths. This could allow a restricted service to perform operations beyond its intended scope, including write operations on plugins it was restricted to read-only access for. This issue is fixed in versions 0.16.1 and 0.17.8.","severity":{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00208,"percentile":0.11007,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-269","CWE-863"],"published":"2026-10-06T20:48:05Z","modified":"2026-10-28T02:30:40Z","fixes":[{"ecosystem":"npm","package":"@backstage/backend-defaults","fixed_in":["0.17.8"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@backstage/backend-defaults","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.17.8"}]}]},{"source":"osv","ecosystem":"npm","package":"@backstage/backend-defaults","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.17.8"}]}]}],"products":[{"vendor":"@backstage","product":"backend-defaults"},{"vendor":"backstage","product":"backstage"},{"vendor":"linuxfoundation","product":"backstage"},{"vendor":"linuxfoundation","product":"backstage\\/backend-defaults"}],"references":[{"url":"https://github.com/backstage/backstage/security/advisories/GHSA-cq7v-rfgc-5c7v","tags":["x_refsource_CONFIRM","Mitigation","Vendor Advisory","advisory","web"]},{"url":"https://github.com/backstage/backstage/commit/40346245c53e1bf26dee56601e95c5c4ab9cc124","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/backstage/backstage/commit/bc80ffdafbc92ff7b8c72347eace13cb8688fd33","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.49.6","tags":["x_refsource_MISC","Patch","Release Notes","web"]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.54.6","tags":["x_refsource_MISC","Patch","Release Notes","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106492","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-cq7v-rfgc-5c7v"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/106xxx/CVE-2026-106492.json","tags":["advisory"]},{"url":"https://github.com/backstage/backstage","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-106492","title":"Backstage: Improper preservation of access restrictions during service credential delegation","description":"Backstage is an open framework for building developer portals. Prior to 0.16.1 and 0.17.8, the @backstage/backend-defaults package is affected by improper preservation of access restrictions during service credential delegation. An external service credential configured with access restrictions (e.g., read-only) could bypass those restrictions by routing requests through plugin delegation paths. This could allow a restricted service to perform operations beyond its intended scope, including write operations on plugins it was restricted to read-only access for. This issue is fixed in versions 0.16.1 and 0.17.8.","status":"published","published":"2026-10-06T20:48:05.896Z","modified":"2026-10-09T01:51:07.252Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-269","CWE-863"],"updated_at":"2026-11-02T14:20:04.156238Z"}],"euvd":[{"id":"EUVD-2026-94012","description":"Backstage is an open framework for building developer portals. Prior to 0.16.1 and 0.17.8, the @backstage/backend-defaults package is affected by improper preservation of access restrictions during service credential delegation. An external service credential configured with access restrictions (e.g., read-only) could bypass those restrictions by routing requests through plugin delegation paths. This could allow a restricted service to perform operations beyond its intended scope, including write operations on plugins it was restricted to read-only access for. This issue is fixed in versions 0.16.1 and 0.17.8.","status":"published","published":"2026-10-06T20:48:05Z","modified":"2026-10-09T01:51:07Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T17:27:25.459601Z"}],"ghsa":[{"id":"GHSA-cq7v-rfgc-5c7v","title":"Backstage: Improper preservation of access restrictions during service credential delegation","description":"### Impact\n\nAn external service credential configured with access restrictions (e.g., read-only) could bypass those restrictions by routing requests through plugin delegation paths. This could allow a restricted service to perform operations beyond its intended scope, including write operations on plugins it was restricted to read-only access for.\n\n### Patches\n\nPatched in `@backstage/backend-defaults` version `0.17.8`\n\n### Workarounds\n\nIf you're unable to upgrade immediately:\n\n- If practical, replace restricted credentials with separate, purpose-specific unrestricted credentials scoped to trusted consumers.\n- Restrict network-level access to Backstage backend API endpoints to trusted callers only.","status":"published","published":"2026-10-07T17:59:43Z","modified":"2026-10-07T17:59:45Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","level":"high"}],"cwes":["CWE-269","CWE-863"],"updated_at":"2026-11-02T14:41:28.013673Z"}],"nvd":[{"id":"CVE-2026-106492","description":"Backstage is an open framework for building developer portals. Prior to 0.16.1 and 0.17.8, the @backstage/backend-defaults package is affected by improper preservation of access restrictions during service credential delegation. An external service credential configured with access restrictions (e.g., read-only) could bypass those restrictions by routing requests through plugin delegation paths. This could allow a restricted service to perform operations beyond its intended scope, including write operations on plugins it was restricted to read-only access for. This issue is fixed in versions 0.16.1 and 0.17.8.","status":"published","published":"2026-10-06T21:17:18.22Z","modified":"2026-10-22T13:40:44.623Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","level":"high","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-269","CWE-863"],"updated_at":"2026-11-02T14:12:54.809359Z"}],"osv":[{"id":"CVE-2026-106492","title":"Backstage: Improper preservation of access restrictions during service credential delegation","description":"Backstage is an open framework for building developer portals. Prior to 0.16.1 and 0.17.8, the @backstage/backend-defaults package is affected by improper preservation of access restrictions during service credential delegation. An external service credential configured with access restrictions (e.g., read-only) could bypass those restrictions by routing requests through plugin delegation paths. This could allow a restricted service to perform operations beyond its intended scope, including write operations on plugins it was restricted to read-only access for. This issue is fixed in versions 0.16.1 and 0.17.8.","status":"published","published":"2026-10-06T20:48:05.896Z","modified":"2026-10-28T02:30:40.573854835Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","level":"high"}],"cwes":["CWE-269","CWE-863"],"updated_at":"2026-11-02T15:44:54.583213Z"},{"id":"GHSA-cq7v-rfgc-5c7v","title":"Backstage: Improper preservation of access restrictions during service credential delegation","description":"### Impact\n\nAn external service credential configured with access restrictions (e.g., read-only) could bypass those restrictions by routing requests through plugin delegation paths. This could allow a restricted service to perform operations beyond its intended scope, including write operations on plugins it was restricted to read-only access for.\n\n### Patches\n\nPatched in `@backstage/backend-defaults` version `0.17.8`\n\n### Workarounds\n\nIf you're unable to upgrade immediately:\n\n- If practical, replace restricted credentials with separate, purpose-specific unrestricted credentials scoped to trusted consumers.\n- Restrict network-level access to Backstage backend API endpoints to trusted callers only.","status":"published","published":"2026-10-07T17:59:43Z","modified":"2026-10-07T18:15:11.766063944Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","level":"high"}],"cwes":["CWE-269","CWE-863"],"updated_at":"2026-11-02T15:46:45.28161Z"}]}}