CVE-2026-106495: Backstage Auth Bypass Vulnerability

CVE-2026-106495 Overview

CVE-2026-106495 is an improper access control vulnerability [CWE-284] in the @backstage/backend-defaults package used by Backstage, an open framework for building developer portals. Versions prior to 0.17.8 fail to enforce operator-defined action exclusions when authenticated users invoke backend actions. An authenticated user can invoke actions that an operator had explicitly excluded through action configuration. Existing action permissions and downstream authorization checks remain enforced, which limits the impact. The issue is resolved in Backstage @backstage/backend-defaults version 0.17.8.

Critical Impact

Authenticated users can invoke actions that administrators intended to disable via configuration-based exclusions, bypassing a layer of defense-in-depth in Backstage backend deployments.

Affected Products

• Backstage @backstage/backend-defaults package prior to version 0.17.8
• Backstage deployments relying on action configuration filters to restrict backend actions
• Fixed in Backstage release v1.54.6

Discovery Timeline

• 2026-10-12 - CVE-2026-106495 published to NVD
• 2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-106495

Vulnerability Analysis

The vulnerability resides in the actions registry within @backstage/backend-defaults. Operators can declare action exclusion rules in configuration to prevent certain backend actions from being invoked. Prior to version 0.17.8, the backend action invocation path did not consistently apply those configuration-based filters. An authenticated user with permission to call the actions service could still trigger an action the operator had excluded.

The scope of impact is limited. Action-level permissions and downstream authorization within each action continue to apply, so this flaw affects the configuration-based exclusion layer rather than the broader authorization model. The CWE-284 classification reflects an improper access control gap in how exclusion policy is enforced.

Root Cause

The actions registry service factory did not consume the root configuration service when deciding whether to expose an action for invocation. Without configuration input, the action filter logic in packages/backend-defaults/src/alpha/entrypoints/actionsRegistry/actionFilters.ts could not evaluate operator-defined exclusion patterns against the action identifier and attributes.

Attack Vector

Exploitation requires an authenticated session against the Backstage backend. The attacker invokes an action identifier that an operator intended to exclude through action configuration. Because the exclusion filter was not applied at invocation time, the action handler executes if its own permission check passes.

// Patch excerpt: actionFilters.ts introduces configuration-driven exclusion
import type { ActionsServiceAction } from '@backstage/backend-plugin-api/alpha';
import type { RootConfigService } from '@backstage/backend-plugin-api';
import type { Config } from '@backstage/config';
import { Minimatch } from 'minimatch';

interface ActionFilterTarget {
  id: string;
  attributes: ActionsServiceAction['attributes'];
}

const ACTION_ATTRIBUTE_KEYS = [
  'destructive',
  'readOnly',
  'idempotent',
// Source: https://github.com/backstage/backstage/commit/a8fb34a990a69bcb745e85a3213cf9e5ba2d31a3

// Patch excerpt: actionsRegistryServiceFactory.ts wires rootConfig into the factory
    httpAuth: coreServices.httpAuth,
    logger: coreServices.logger,
    auth: coreServices.auth,
    config: coreServices.rootConfig,
    permissions: coreServices.permissions,
    permissionsRegistry: coreServices.permissionsRegistry,
// Source: https://github.com/backstage/backstage/commit/a8fb34a990a69bcb745e85a3213cf9e5ba2d31a3

Detection Methods for CVE-2026-106495

Indicators of Compromise

• Successful invocation events for action identifiers that match patterns in the operator's action exclusion configuration.
• Audit log entries showing authenticated users calling actions that should be unavailable per deployment policy.
• Unexpected downstream side effects from excluded actions, such as external API calls or resource mutations.

Detection Strategies

• Compare backend action invocation logs against the configured exclusion list for @backstage/backend-defaults and alert on mismatches.
• Baseline the set of actions each user or group normally invokes and flag calls to newly observed or restricted action IDs.
• Monitor Backstage backend logs for authenticated requests to the actions registry endpoints targeting excluded identifiers.

Monitoring Recommendations

• Forward Backstage backend application logs and audit events to a central SIEM for correlation and retention.
• Track the installed version of @backstage/backend-defaults across environments and alert when any instance remains below 0.17.8.
• Review the GitHub Security Advisory GHSA-3xr5-8w6c-p5gw for additional vendor guidance.

How to Mitigate CVE-2026-106495

Immediate Actions Required

• Upgrade @backstage/backend-defaults to version 0.17.8 or later across all Backstage backend deployments.
• Adopt the Backstage Release v1.54.6 bundle, which includes the fixed package.
• Audit action invocation logs since the vulnerable version was deployed to identify any use of excluded actions.

Patch Information

The fix is delivered in @backstage/backend-defaults0.17.8 and bundled in Backstage release v1.54.6. The patch wires coreServices.rootConfig into the actions registry service factory and introduces consistent configuration-driven filtering in actionFilters.ts. Review the Backstage GitHub commit a8fb34a for the full change set.

Workarounds

• Enforce action restrictions through action-level permissions and downstream authorization rather than relying solely on configuration-based exclusion until patched.
• Restrict access to the Backstage backend to trusted authenticated users and reduce the blast radius of invokable actions.
• Remove or disable backend plugins that register sensitive actions if they cannot be upgraded immediately.

# Upgrade the affected package to the fixed version
yarn up @backstage/backend-defaults@^0.17.8

# Verify the installed version
yarn why @backstage/backend-defaults