# CVE-2026-106492: Backstage backend-defaults service credential delegation bypass

Source: https://junglewise.ai/threats/cve-2026-106492-backstage-is-an-open-framework-for-building-developer-portals  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-06. Updated: 2026-10-06  
License: CC BY 4.0 with a link back

CVE-2026-106492 · Severity: high · CVSS 7.6 · Published 2026-10-06

Backstage is an open framework for building developer portals that organizations use to manage internal services and integrations. A vulnerability in its service credential handling allows restricted service credentials to bypass access controls through plugin delegation paths, potentially allowing a read-only service to perform write operations it was not authorized for.

Technologies: [Backstage @Backstage/Backend-Defaults](https://junglewise.ai/threats/technologies/backend-defaults), [@backstage/backend-defaults (npm)](https://junglewise.ai/threats/technologies/backstage-backend-defaults). Vendors: [Backstage](https://junglewise.ai/threats/vendors/backstage), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-106492 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-106492 being exploited in the wild.

**How severe is CVE-2026-106492?** High severity, with a CVSS score of 7.6, published 6 October 2026.

**Which products and versions are affected?** Backstage @Backstage/Backend-Defaults before 0.16.1 and 0.17.8; @backstage/backend-defaults (npm) < 0.17.8, SEMVER:introduced=0,fixed=0.17.8.

**Is there a fix for CVE-2026-106492?** Yes. @backstage/backend-defaults (npm): upgrade to 0.17.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-106492 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-106492?** Check whether you run Backstage @Backstage/Backend-Defaults or @backstage/backend-defaults (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @backstage/backend-defaults (npm): upgrade to 0.17.8 or later

  ```sh
  npm install @backstage/backend-defaults@0.17.8
  ```


## Technical details

The @backstage/backend-defaults package fails to preserve access restrictions during service credential delegation between plugins. An attacker with a restricted service credential can bypass those restrictions by routing requests through plugin-to-plugin delegation paths, gaining unauthorized access to perform operations beyond the credential's intended scope. The vulnerability requires control of a service credential with defined access restrictions.

## Affected products

- Backstage @backstage/backend-defaults before 0.16.1 and 0.17.8

## Identifiers

- CVE-2026-106492
- GHSA-cq7v-rfgc-5c7v

## Timeline

- 2026-10-06: disclosed

## References

- [https://github.com/backstage/backstage/commit/40346245c53e1bf26dee56601e95c5c4ab9cc124](https://github.com/backstage/backstage/commit/40346245c53e1bf26dee56601e95c5c4ab9cc124)
- [https://github.com/backstage/backstage/commit/bc80ffdafbc92ff7b8c72347eace13cb8688fd33](https://github.com/backstage/backstage/commit/bc80ffdafbc92ff7b8c72347eace13cb8688fd33)

## Related threats

- [Backstage backend-defaults improper access control in action invocation](https://junglewise.ai/threats/cve-2026-106495-backstage-improper-access-control-in-backend-action-invocation)
- [Backstage backend-defaults path traversal in cloud storage URL readers](https://junglewise.ai/threats/cve-2026-106494-backstage-is-an-open-framework-for-building-developer-portals)
- [Backstage: Cloud storage catalog locations may cross configured storage boundaries](https://junglewise.ai/threats/cve-2026-106493-backstage-is-an-open-framework-for-building-developer-portals)
- [Backstage Scaffolder symlink path traversal in multiple actions](https://junglewise.ai/threats/cve-2026-24046-backstage-scaffolder-symlink-path-traversal-in-multiple-actions)