CVE-2026-106492

Summary

A vulnerability in Backstage's @backstage/backend-defaults package allows restricted service credentials to bypass access restrictions during plugin delegation, potentially enabling unauthorized write operations beyond their intended read-only scope.

Exploitability

Exploitation requires an attacker to have access to a service credential with restricted permissions and to be able to route requests through plugin delegation paths, making it moderately difficult to exploit without prior access.

Blast radius

If exploited, this vulnerability could allow attackers to perform unauthorized write operations on plugins they were originally restricted from modifying, potentially leading to data corruption or privilege escalation within the developer portal.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 0.16.1 or 0.17.8 to fix the access restriction bypass issue in @backstage/backend-defaults package.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.