CVE-2026-106457

Executive Summary

CVE-2026-106457 is an improper authentication vulnerability (CWE-287) in the Backstage @backstage/plugin-auth-backend-module-cloudflare-access-provider package, affecting versions 0.1.0 through 0.4.x. The Cloudflare Access auth provider verifies token signature and team issuer but fails to validate the token audience, allowing a token issued for a different application within the same Cloudflare Zero Trust team to authenticate to the Backstage application. Successful exploitation grants an attacker authenticated access to Backstage, with high confidentiality and integrity impact (CVSS 6.8). The vulnerability is fixed in version 0.5.0; no public PoC or known exploitation in the wild has been observed.

Technical Analysis

Backstage is an open-source framework for building developer portals, and the affected component is an authentication backend module that integrates Cloudflare Access as an identity provider. Cloudflare Access issues signed JSON Web Tokens (JWTs) to users who have been authenticated against a protected application. These tokens contain standard claims including an audience (aud) claim that binds the token to the specific Access application it was issued for, and an issuer (iss) claim tied to the Cloudflare Zero Trust team.

The vulnerability lies in the token validation logic of the Cloudflare Access auth provider. Affected versions (0.1.0 until 0.5.0) verify the token's cryptographic signature and the team issuer, but do not verify that the token's audience claim corresponds to the Backstage application. In a properly configured Cloudflare Access deployment, the Access edge validates the audience before forwarding a request to the origin. However, the NVD description explicitly notes that this issue is exploitable "if that token reaches the auth endpoint without the Backstage application's audience already being enforced upstream."

This creates an audience-confusion condition: any holder of a valid Cloudflare Access token — issued by the same Zero Trust team but for a different Access application — can present it to the Backstage auth endpoint and be granted a session, because the module accepts the token based solely on signature and issuer validity. CWE-287 (Improper Authentication) is the assigned weakness class, reflecting that the system fails to adequately prove the identity claim before granting access.

Key technical parameters derived from the description:

• Token type: Cloudflare Access JWT.
• Broken control: Audience (aud) validation.
• Controls still present: Signature verification and team issuer verification.
• Precondition: The attacker's token must originate from the same Cloudflare Zero Trust team as the Backstage deployment, and the request must reach the auth endpoint without upstream audience enforcement.

The attack surface is the Backstage authentication HTTP endpoint exposed by the affected module. No pre-authentication code execution exists; this is an authentication-bypass / authorization-confusion flaw. Because no patch-level source diff is available in this dataset, only the validation gap described by NVD should be assumed — no specific function names or internal APIs are asserted here.

Exploitation Scenarios

The following chain is inferred from the vulnerability class (improper audience validation in JWT-based auth) and the NVD description; no public PoC exists, so exploit specifics are not confirmed.

1. Reconnaissance / target identification. An attacker identifies an organization using Backstage with the Cloudflare Access auth provider enabled. The attacker must already possess (or obtain) legitimate access to any Cloudflare Access application within the same Zero Trust team. This could be a low-privilege internal application, a partner portal, or a misconfigured app that grants broad team access. The attacker maps the Backstage auth endpoint (the callback/auth route exposed by the plugin) to establish the request path.

2. Triggering the flaw class. The attacker obtains a valid Cloudflare Access JWT for an application that is not Backstage but belongs to the same team. Because affected versions validate signature and issuer only, the audience mismatch is never checked. The attacker submits this token to the Backstage auth endpoint.

3. Payload / execution (class level). The request carries the valid-but-mis-scoped token. The provider verifies the signature against Cloudflare's signing keys and confirms the issuer matches the team, then — critically — proceeds to establish an authenticated Backstage session without confirming the aud claim. In a normal deployment, Cloudflare Access evaluates the protected application and enforces audience upstream, so this request would be blocked. The exploit materializes only under the condition stated by NVD: the token reaches the auth endpoint without the Backstage audience being enforced upstream (e.g., origin directly reachable, misconfigured bypass, or internal path that skips Access).

4. Post-exploitation impact. On success, the attacker is authenticated to Backstage as the identity associated with the mis-scoped token. This yields access to the developer portal's data and functions — software catalog, documentation, scaffolding templates, and potentially CI/CD-related plugins — with high confidentiality and integrity impact, as reflected in the CVSS subscores.

Preconditions (all required): same-team token possession; a reachable auth endpoint without upstream audience enforcement. No public PoC, exploit code, or Nuclei template is available.

Impact Assessment

CVSS v3.1 base score is 6.8 (Medium) with vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N.

• Attack Vector (Network): the auth endpoint is remotely reachable.
• Attack Complexity (High): exploitation requires a valid token from the same Zero Trust team and a path that bypasses upstream audience enforcement.
• Privileges Required (Low): the attacker needs a valid Access token for some application in the team.
• User Interaction (None): no victim action required.
• Scope (Unchanged): impact confined to the Backstage application's security authority.
• Confidentiality (High) / Integrity (High) / Availability (None): authenticated access exposes and can modify developer-portal data; no direct availability loss.

Business impact: Unauthorized access to a developer portal typically exposes the software catalog, service ownership data, secrets/configuration exposed via plugins, and CI/CD orchestration surfaces. Because Backstage often sits at the center of engineering workflows, an authenticated foothold can serve as a pivot point for supply-chain-adjacent activity. Blast radius is limited to environments where (a) the plugin is deployed in affected versions, and (b) an upstream audience check is not guaranteed. EPSS: not yet scored by FIRST.org. CISA KEV: not listed. No exploit-in-the-wild evidence.

Detection Guidance

Sigma Rule

title: Backstage Cloudflare Access Auth - Suspicious Token Audience Mismatch
id: 8f3c1a2e-5b7d-4e9a-9c1f-2d6a4b8e0f31
status: experimental
description: Detects authentication events to the Backstage Cloudflare Access auth provider where a token is accepted without audience validation, or where token audience does not match the Backstage application.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-106457
author: Valters IT Threat Intelligence
date: 2026/01/01
logsource:
  product: backstage
  service: auth
detection:
  selection_endpoint:
    url.path|contains: 'cloudflare-access'
  selection_outcome:
    event.outcome: 'success'
  selection_context:
    - token.audience_missing: true
    - token.audience_mismatch: true
    - cloudflare_access.audience_validated: false
  condition: selection_endpoint and selection_outcome and selection_context
falsepositives:
  - Legitimate first-time logins during initial deployment testing
level: high
tags:
  - attack.t1078
  - cve.2026.106457

YARA Rule

rule CVE_2026_106457_Backstage_CFAccess_Audience_Bypass
{
    meta:
        description = "Detects Backstage Cloudflare Access auth provider versions lacking audience validation"
        author = "Valters IT Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-106457"
        cve = "CVE-2026-106457"
        date = "2026-01-01"

    strings:
        $pkg  = "@backstage/plugin-auth-backend-module-cloudflare-access-provider"
        $ver1 = "0.1.0"
        $ver2 = "0.2." ascii
        $ver3 = "0.3." ascii
        $ver4 = "0.4." ascii
        $vers = "\"version\":" ascii
        $cf   = "cloudflare-access" nocase ascii

    condition:
        $pkg and $cf and $vers and any of ($ver*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-106457 Backstage Cloudflare Access Auth Audience Bypass Attempt"; flow:to_server,established; content:"cloudflare-access"; http_uri; nocase; content:"cf-access-jwt-assertion"; http_header; nocase; reference:cve,2026-106457; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-106457; classtype:attempted-user; sid:2026106457; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [authentication where event.action == "login_attempt" and url.path : "*cloudflare-access*"]
  [authentication where event.outcome == "success" and url.path : "*cloudflare-access*" and
     not token.audience : "*backstage*"]

Splunk SPL Query

index=backstage sourcetype=backstage:auth OR sourcetype=backstage:server
| search ("cloudflare-access" OR "/api/auth/cloudflare" OR cloudflare_access)
| where (isnull('token.audience') OR 'token.audience'="*" OR NOT match('token.audience',"(?i)backstage"))
| stats count values(url.path) as paths values(src_ip) as src_ips by user, status
| where status="success" OR status="200"
| sort - count

Wazuh OSSEC Rule

<group name="backstage,cloudflare_access,">
  <rule id="100457" level="12">
    <decoded_as>json</decoded_as>
    <field name="url.path">cloudflare-access</field>
    <field name="event.outcome">success</field>
    <field name="cloudflare_access.audience_validated" negate="yes">true</field>
    <description>CVE-2026-106457: Backstage Cloudflare Access authentication succeeded without audience validation</description>
    <mitre>
      <id>T1078</id>
    </mitre>
    <group>authentication_bypass,cve_2026_106457,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1) Immediate mitigations

• Enforce Cloudflare Access audience validation upstream so every request reaching the Backstage auth endpoint has already been scoped to the Backstage application. This directly addresses the NVD-stated precondition that the token must arrive "without the Backstage application's audience already being enforced upstream."
• Ensure the Backstage auth endpoint is not directly reachable bypassing Cloudflare Access (lock down origin, restrict ingress to Cloudflare, use tunnel/service-token protections).
• Restrict and audit all users/applications within the same Cloudflare Zero Trust team; a broader team footprint increases exposure.
• Monitor auth logs for successful cloudflare-access authentications lacking a Backstage-scoped audience.

2) Patch / upgrade steps

• Upgrade @backstage/plugin-auth-backend-module-cloudflare-access-provider to 0.5.0, which the vendor states fixes the issue by adding audience validation.
• Validate the upgrade by confirming tokens from other applications in the same team are now rejected.
• Note: 0/4 patch confidence — no independent patch evidence available from tracked sources; verify the fixed version directly against the vendor advisory.

3) Long-term hardening

• Standardize strict JWT claim validation (aud, iss, exp, nbf) across all identity-provider plugins.
• Adopt defense-in-depth: never rely solely on upstream enforcement for authentication-critical checks.
• Implement continuous access review for Cloudflare Zero Trust team membership to minimize cross-application token reuse.
• Add CI/CD policy checks that flag auth modules missing audience validation, and pin/audit dependencies on authentication-related packages.

References

1. NVD — CVE-2026-106457: https://nvd.nist.gov/vuln/detail/CVE-2026-106457
2. Backstage project (GitHub: backstage/backstage) — package @backstage/plugin-auth-backend-module-cloudflare-access-provider, fix in 0.5.0
3. Cloudflare Access documentation — JWT and audience (aud) claim validation for Zero Trust applications
4. CWE-287 — Improper Authentication: https://cwe.mitre.org/data/definitions/287.html
5. MITRE ATT&CK T1078 — Valid Accounts: https://attack.mitre.org/techniques/T1078/

No known threat actor campaigns or exploit-in-the-wild evidence identified. CISA KEV: not applicable. EPSS: not yet scored by FIRST.org.