CVE-2026-106562

Name of the Vulnerable Software and Affected Versions @backstage/plugin-search-backend versions prior to 2.1.6 @backstage/plugin-search-backend-module-elasticsearch versions prior to 1.8.7

Description An authenticated user could receive unauthorized search results when a DENY policy is applied to search document types. This occurs in deployments where permission.enabled is set to true and an Elasticsearch or OpenSearch backend is used, as the search engine permission filtering may return documents that should be denied by policy.

Recommendations Upgrade @backstage/plugin-search-backend to 2.1.6. Upgrade @backstage/plugin-search-backend-module-elasticsearch to 1.8.7. Modify permission policies to use CONDITIONAL decisions with per-result filtering instead of blanket DENY for search document types. Restrict Elasticsearch or OpenSearch index access at the cluster level to ensure the search service account only accesses expected Backstage indices.