CVE-2026-106458: Backstage Auth Bypass Vulnerability

CVE-2026-106458 Overview

CVE-2026-106458 affects the @backstage/plugin-catalog-backend-module-bitbucket-server package used by Backstage, an open framework for building developer portals. Versions from 0.4.0 up to 0.5.15 inconsistently apply repository filters when processing Bitbucket Server catalog event updates. Deployments relying on event-driven updates may ingest catalog locations from repositories that the provider's projectKey, repositoryName, or archived-repository filters should exclude. The flaw is categorized under CWE-863: Incorrect Authorization and is fixed in version 0.5.15.

Critical Impact
An authenticated Bitbucket Server user who can push to a filtered-out but readable repository can trigger a repository event that causes Backstage to register a Location for that repository, bypassing the configured discovery scope.

Affected Products

Backstage @backstage/plugin-catalog-backend-module-bitbucket-server versions 0.4.0 through 0.5.14
Backstage deployments using event-driven catalog updates against Bitbucket Server
Backstage releases prior to v1.55.0

Discovery Timeline

2026-10-06 - CVE-2026-106458 published to NVD
2026-10-07 - Last updated in NVD database

Technical Details for CVE-2026-106458

Vulnerability Analysis

The BitbucketServerEntityProvider enforces repository filters during scheduled discovery but applies them inconsistently in the event-driven update path. When a Bitbucket Server repository event arrives, the provider processes the referenced repository without re-validating it against the full filter set used during scheduled scans. This allows ingestion of catalog-info.yaml Locations from repositories outside the intended discovery scope.

The issue arises because the scheduled discovery loop and the event handler use different filter-checking logic. The patch introduces a shared matchesRepositoryFilters helper so both code paths evaluate the same projectKey, repositoryName, and archived flags.

Root Cause

The root cause is incorrect authorization logic [CWE-863] in the Bitbucket Server catalog provider. Filter evaluation was duplicated across the scheduled and event-driven code paths, and the event path omitted checks that scheduled discovery enforced. A repository readable by the Backstage integration account but excluded by configuration therefore remained eligible for Location ingestion through events.

Attack Vector

An authenticated Bitbucket Server user with push access to a filtered-out repository publishes a commit containing a catalog-info.yaml descriptor. The resulting Bitbucket Server webhook event reaches Backstage, which processes it without re-applying the project, repository, or archived filters. Backstage then creates a Location entity pointing at the attacker-controlled repository, injecting attacker-supplied catalog entities into the developer portal.

typescript

// Patch excerpt: unified filter enforcement in BitbucketServerEntityProvider.ts
    );
    const result: Entity[] = [];
    for await (const project of projects) {
-      if (
-        this.config?.filters?.projectKey &&
-        !this.config.filters.projectKey.test(project.key)
-      ) {
+      if (!this.matchesRepositoryFilters({ projectKey: project.key })) {
        continue;
      }
      const repositories = paginated(options =>
// Source: https://github.com/backstage/backstage/commit/989db63b6f87c8fc04d440f296ad89e10c79b363

The accompanying configuration schema change clarifies that filters now apply to both scheduled and event-driven updates. See the GitHub Security Advisory GHSA-c36c-cf6r-ghgj for full details.

Detection Methods for CVE-2026-106458

Indicators of Compromise

Catalog Location entries whose source repository matches an excluded projectKey or repositoryName filter in app-config.yaml
Backstage audit log entries showing entity ingestion originating from archived Bitbucket Server repositories
Unexpected catalog-info.yaml files committed to filtered-out repositories by non-platform users

Detection Strategies

Compare the active Backstage catalog entity set against the Bitbucket Server provider's configured filters and flag any entity whose source URL falls outside the allowed scope.
Review Bitbucket Server webhook delivery logs for repository push events originating from filtered repositories that were accepted by Backstage.
Audit git history on filtered repositories for recent additions of catalog-info.yaml or other recognized Backstage descriptor files.

Monitoring Recommendations

Enable Backstage catalog audit logging and forward events to a centralized SIEM for continuous review.
Alert on new Location entities created outside expected organizational projects.
Monitor Bitbucket Server access logs for integration-account reads against repositories that should be excluded by policy.

How to Mitigate CVE-2026-106458

Immediate Actions Required

Upgrade @backstage/plugin-catalog-backend-module-bitbucket-server to version 0.5.15 or later, or upgrade Backstage to v1.55.0 or later.
Audit the Backstage catalog for Location entities sourced from repositories outside the configured filter scope and remove any unauthorized entries.
Review the Bitbucket Server integration account's repository read permissions and restrict access to only in-scope projects.

Patch Information

The fix is implemented in commit 989db63 and shipped in Backstage release v1.55.0. The patch introduces a shared matchesRepositoryFilters helper that enforces projectKey, repositoryName, and archived-repository filters uniformly across scheduled discovery and event-driven updates.

Workarounds

Disable event-driven updates for the Bitbucket Server catalog provider and rely solely on scheduled discovery until the patch can be applied.
Restrict the Backstage integration account's Bitbucket Server read permissions to only the projects and repositories that should be in catalog scope.
Remove webhook subscriptions that deliver repository events from excluded projects to the Backstage instance.

bash

# Upgrade the affected plugin to the fixed version
yarn workspace backend add @backstage/plugin-catalog-backend-module-bitbucket-server@^0.5.15

# Verify the installed version
yarn why @backstage/plugin-catalog-backend-module-bitbucket-server