CVE-2026-106458

Executive Summary

CVE-2026-106458 is an access control bypass (CWE-863) in the @backstage/plugin-catalog-backend-module-bitbucket-server package, affecting Backstage deployments between versions 0.4.0 and 0.5.14. The Bitbucket Server catalog provider's event-driven update path applies repository filtering inconsistently, allowing an authenticated Bitbucket Server user with push access to an otherwise filtered-out repository to inject a catalog Location that scheduled discovery would have excluded. The vulnerability has a CVSS score of 6.5, reflecting high integrity impact to the Backstage catalog, with no confidentiality or availability impact.

Technical Analysis

Backstage is an open framework for building developer portals. The affected component is the Bitbucket Server catalog backend module, which supports two mechanisms for ingesting catalog entities: scheduled discovery and event-driven updates. The NVD description states that "from 0.4.0 until 0.5.15, the @backstage/plugin-catalog-backend-module-bitbucket-server package is affected by inconsistent repository filtering in bitbucket server catalog event updates." The core defect is a divergence between the filtering logic applied during scheduled discovery versus the filtering logic applied when an event is processed.

The provider can be configured with filters scoped to a project, to specific repositories, and to exclude archived repositories. During scheduled (polling-based) discovery, these filters are respected, so repositories outside the configured scope are never added to the catalog. However, when a repository event is received via the event-driven path, the filtering is applied inconsistently — meaning the event path may accept and process an event for a repository that the scheduled path would reject.

An authenticated Bitbucket Server user who can push to a filtered-out repository — one that remains readable by the configured Backstage integration credentials — can trigger a legitimate repository event (for example, a push or repository update). Because the event is genuine from Bitbucket Server's perspective, it passes whatever event authentication exists. The event handler then processes the repository and "may then add a Location for that repository even though scheduled discovery excludes it."

The weakness class is CWE-863: Incorrect Authorization. The authorization decision (does this repository fall within the configured project/repository/archived filters?) is evaluated differently depending on the code path, enabling a bypass. Note that the exact filter-evaluation function names, the event handler class names, and the precise conditional branches are not disclosed in the available advisory text, so this analysis is limited to the documented behavior rather than specific code constructs.

Key points:

• Attack vector is network (AV:N), complexity low (AC:L), privileges required are low (PR:L) — the attacker must be a valid, authenticated Bitbucket Server user.
• No user interaction (UI:N) is needed; the attacker acts by pushing to a repository.
• Integrity impact is High (I:H) to the Backstage catalog; confidentiality and availability impacts are None.
• The scope is unchanged (S:U) — the vulnerable component is the Backstage catalog backend, which is what is impacted.

Exploitation Scenarios

Note: No public PoC or exploit code is available. The following chain is inferred from the vulnerability class (CWE-863, incorrect authorization) and the NVD description.

1. Reconnaissance / target identification: The attacker identifies a Backstage deployment that uses the Bitbucket Server catalog provider with event-driven updates enabled and configured with project, repository, or archived-repository filters. The attacker confirms they hold an authenticated Bitbucket Server account with push rights to a repository that is filtered out of the Backstage catalog scope but still readable by the Backstage integration account — read access by the integration is required for the event path to successfully retrieve the repository.

2. Triggering the flaw: The attacker pushes a change to the filtered-out repository. This generates a legitimate repository event from Bitbucket Server. Because the event is authentic, it is delivered to the Backstage event-driven update path. The vulnerability is triggered at the authorization-decision point: the event path evaluates repository scope inconsistently with the scheduled discovery path, so the repository is not rejected.

3. Payload / execution method: At the vulnerability-class level, no memory-corruption or code-execution payload is required. The "payload" is the ordinary repository event itself. The event handler processes the repository and may add a Location for it to the catalog — despite that repository being excluded by the provider's configured filters and despite scheduled discovery never adding it. No specific function names, endpoints, or API parameters are provided in the advisory, so the exact call sequence cannot be documented here.

4. Post-exploitation impact: The attacker causes unauthorized catalog entries (Locations) to be introduced for repositories outside the sanctioned scope. Depending on how the catalog consumes those locations, this can pollute the developer portal's software catalog with out-of-scope entities, potentially surfacing attacker-controlled repository content as trusted catalog entries. The integrity impact is rated High; there is no direct confidentiality or availability impact described.

Impact Assessment

Business impact centers on the trustworthiness of the Backstage developer portal catalog. Catalog data is typically treated as authoritative for ownership, service metadata, and dependency mapping; unauthorized injection of Locations can corrupt that authoritative view. Because the attacker must be an authenticated Bitbucket Server user with push rights, this is an insider-or-compromised-account scenario rather than a remote unauthenticated attack, which constrains but does not eliminate risk.

CVSS v3.1 subscores: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N — base score 6.5 (Medium). The High integrity subscore reflects that unauthorized catalog entries can be created. The None confidentiality and None availability subscores reflect that the described behavior does not disclose secrets or cause denial of service.

Blast radius: limited to Backstage deployments using the Bitbucket Server catalog provider (package versions 0.4.0 through 0.5.14) with event-driven updates configured. Environments relying solely on scheduled discovery are not affected by the inconsistent event path. There is no data indicating active exploitation, CISA KEV listing, or public exploit code.

Detection Guidance

Sigma Rule

title: Backstage Bitbucket Server Catalog Filter Bypass via Event Updates
id: 3f1a9c02-7b64-4e21-9c8d-0a1b2c3d4e5f
status: experimental
description: Detects catalog Location ingestion for repositories outside configured Bitbucket Server provider filters via the event-driven update path (CVE-2026-106458).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-106458
author: Threat Intelligence
date: 2026/01/01
logsource:
  product: backstage
  service: catalog-backend
detection:
  selection_event:
    event_type: 'bitbucketServer.repository.updated'
  selection_location:
    message|contains:
      - 'adding location'
      - 'processEntities'
  selection_module:
    logger|contains: 'plugin-catalog-backend-module-bitbucket-server'
  condition: selection_module and selection_event and selection_location
falsepositives:
  - Legitimate repositories within configured filters being processed via events
level: medium
tags:
  - attack.t1190
  - cwe.863

YARA Rule

rule CVE_2026_106458_Backstage_Bitbucket_Filter_Bypass
{
    meta:
        description = "Detects references to event-driven catalog updates in Backstage Bitbucket Server module affected by filter bypass CVE-2026-106458"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-106458"
        cve = "CVE-2026-106458"

    strings:
        $pkg = "@backstage/plugin-catalog-backend-module-bitbucket-server" ascii wide
        $evt1 = "bitbucketServer" ascii wide
        $evt2 = "processEntities" ascii wide
        $ver = /0\.5\.(1[0-4]|[0-9])\b/ ascii

    condition:
        any of ($pkg, $evt1) and 1 of ($evt2, $ver)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-106458 Backstage Bitbucket Server catalog filter bypass event update"; flow:to_server,established; http.header; content:"X-Event-Key"; nocase; content:"repo:push"; nocase; classtype:attempted-user; reference:cve,2026-106458; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-106458; sid:2026106458; rev:1;)

Elastic Detection

sequence by host.id, user.id with maxspan=5m
  [any where event.action == "repository_push" and process.name : "*bitbucket*"]
  [any where event.category == "process" and event.action == "location_added" and process.name : "*backstage*"]

Splunk SPL Query

index=backstage sourcetype=backstage:catalog
| search "plugin-catalog-backend-module-bitbucket-server"
| search ("adding location" OR "processEntities" OR "bitbucketServer.repository")
| eval repos=coalesce(repository, repo, location)
| stats count values(repos) as repositories by host, user
| where count > 0

Wazuh OSSEC Rule

<group name="backstage,cve-2026-106458,">
  <rule id="106458" level="10">
    <decoded_as>json</decoded_as>
    <field name="logger">plugin-catalog-backend-module-bitbucket-server</field>
    <field name="event_type">bitbucketServer.repository</field>
    <match>adding location|processEntities</match>
    <description>CVE-2026-106458: Backstage Bitbucket Server catalog Location added via event path for filtered-out repository</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cwe_863,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). Note: the NVD description states the issue "is fixed in version 0.5.15," but no patch source in the tracked evidence set confirms a published fix, so operators must independently verify availability of 0.5.15 in their registry.

1. Immediate mitigations:

   • Disable event-driven catalog updates for the Bitbucket Server provider and rely on scheduled discovery, which applies the project/repository/archived filters consistently.
   • Ensure the Backstage integration account has read access only to repositories that are within the intended catalog scope, so out-of-scope push events yield no readable repository to ingest.
   • Audit and constrain which Bitbucket Server users can push to repositories that are readable by the integration but intentionally filtered out of Backstage scope.
   • Review the current catalog for unexpected Locations corresponding to filtered-out repositories.

2. Patch/upgrade steps:

   • Upgrade @backstage/plugin-catalog-backend-module-bitbucket-server to version 0.5.15 or later, and verify the installed version in package.json / lockfile after upgrade.
   • Re-enable event-driven updates only after confirming the filtering behavior is consistent across scheduled and event paths.

3. Long-term hardening:

   • Centralize the repository filter-evaluation logic so scheduled discovery and event-driven updates share a single authorization decision (addresses the CWE-863 root cause).
   • Add automated tests asserting that filtered-out repositories are never ingested via the event path.
   • Apply least privilege to the Bitbucket Server integration account and monitor catalog mutations for out-of-scope entries.

References

• NVD — CVE-2026-106458: https://nvd.nist.gov/vuln/detail/CVE-2026-106458
• Backstage project documentation and advisory channels (verify current release notes for @backstage/plugin-catalog-backend-module-bitbucket-server 0.5.15)
• CWE-863: Incorrect Authorization — https://cwe.mitre.org/data/definitions/863.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CISA Known Exploited Vulnerabilities catalog: not listed as of this report.

Threat actor campaigns / exploit-in-the-wild: No evidence of active exploitation, public PoC, or known threat actor campaigns is associated with CVE-2026-106458 in the provided intelligence data.