CVE-2026-106492 Backstage: Improper preservation of access restrictions during service credential delegation
Attackers can bypass service credential access restrictions in Backstage to perform unauthorized write operations via plugin delegation paths.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-106492?
CVE-2026-106492 is a high-severity vulnerability in Linuxfoundation Backstage, published on 6 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Backstage is an open framework for building developer portals. Prior to 0.16.1 and 0.17.8, the @backstage/backend-defaults package is affected by improper preservation of access restrictions during service credential delegation. An external service credential configured with access restrictions (e.g., read-only) could bypass those restrictions by routing requests through plugin delegation paths. This could allow a restricted service to perform operations beyond its intended scope, including write operations on plugins it was restricted to read-only access for. This issue is fixed in versions 0.16.1 and 0.17.8.
Which versions are affected by CVE-2026-106492?
2 open source packages ship an affected version, including @backstage/backend-defaults. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
@backstage/backend-defaults npm | All versions | 0.17.8 |
@backstage/backend-defaults npm | All versions | 0.17.8 |
Products include Linuxfoundation Backstage, Linuxfoundation Backstage\/Backend-Defaults.
How do I fix CVE-2026-106492?
Upgrade @backstage/backend-defaults to 0.17.8 or later.
Is CVE-2026-106492 being exploited?
There is no known exploitation of CVE-2026-106492 in the wild and no public exploit code.
Other vulnerabilities in Linuxfoundation Backstage
- CVE-2026-106501 Backstage: Sensitive information exposure in Scaffolder
- CVE-2026-106558 Backstage: Improper validation of TechDocs MkDocs configuration
- CVE-2026-88064 Backstage: Improper input validation in TechDocs MkDocs configuration
- CVE-2026-106459 Backstage: Improper input validation in Sentry scaffolder actions
- CVE-2026-106486 Backstage: Improper filesystem validation in Bitbucket pull-request scaffolder actions
Sources
Also known as GHSA-cq7v-rfgc-5c7v.