CVE-2026-106492

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 0.16.1 Backstage versions prior to 0.17.8

Description The @backstage/backend-defaults package fails to properly preserve access restrictions during service credential delegation. An external service credential configured with restrictions, such as read-only access, can bypass these limits by routing requests through plugin delegation paths. This allows a restricted service to perform unauthorized operations, including write actions on plugins where it should only have read-only permissions.

Recommendations Update to version 0.16.1. Update to version 0.17.8.