Log in Start free

Vulnerability · Published Oct 6, 2026 · Assigned by GitHub_M

CVE-2026-106492Backstage: Improper preservation of access restrictions during service credential delegation

High 7.6

In plain English

A high-severity privilege mismanagement in backend-defaults from @backstage. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.6High
Exploit odds (30 days)0.2%top 89.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Backstage is an open framework for building developer portals. Prior to 0.16.1 and 0.17.8, the @backstage/backend-defaults package is affected by improper preservation of access restrictions during service credential delegation. An external service credential configured with access restrictions (e.g., read-only) could bypass those restrictions by routing requests through plugin delegation paths. This could allow a restricted service to perform operations beyond its intended scope, including write operations on plugins it was restricted to read-only access for. This issue is fixed in versions 0.16.1 and 0.17.8.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
npm@backstage/backend-defaults0.17.8GHSA-cq7v-rfgc-5c7v

Affected products (as reported)

VendorProductVersions
backstage backstage < 1.49.6>= 1.50.0-next.0, < 1.54.6
@backstage backend-defaults < 0.16.1>= 0.17.0, < 0.17.8

Weakness: CWE-269, CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

References