CVE-2026-106487

Executive Summary

CVE-2026-106487 is an unsupported catalog cluster authentication mode vulnerability in the @backstage/plugin-kubernetes-backend package, affecting Backstage deployments prior to version 0.21.10. Organizations using catalog cluster discovery are at risk when catalog contributors can create or modify kubernetes-cluster Resource entities, potentially allowing the backend to authenticate using its local in-cluster identity against catalog-supplied endpoints, thereby exposing Kubernetes resources accessible to that identity. The vulnerability carries a CVSS score of 3.5, indicating low severity but non-trivial confidentiality impact in multi-tenant or delegated catalog environments.

Technical Analysis

Backstage is an open framework for building developer portals, and the @backstage/plugin-kubernetes-backend plugin provides Kubernetes integration capabilities. This vulnerability stems from a design weakness in how the plugin handles authentication modes for clusters discovered via the software catalog. Specifically, when catalog cluster discovery is enabled, the backend may process kubernetes-cluster Resource entities contributed by catalog users and attempt to connect to the endpoints they specify. Under certain configurations, rather than using a catalog-supplied credential or explicitly configured authentication method, the plugin falls back to using its own local in-cluster service account identity.

The core issue maps to CWE-441: Unintended Proxy or Intermediary (Confused Deputy). An attacker who can create or modify a kubernetes-cluster Resource entity in the catalog can influence which endpoint the backend contacts. If the attacker supplies an endpoint that routes back to the local cluster API, or if the backend logic incorrectly applies the in-cluster identity to a catalog-controlled connection, the backend acts as a confused deputy. The backend’s privileged in-cluster service account token is then used to make API calls to the Kubernetes API server, and the results may be returned to the attacker. Critically, the NVD description clarifies that the credential is used only with the local in-cluster API endpoint and is not sent to the catalog-supplied endpoint; however, the backend can still be coerced into using its local identity to read resources that the attacker should not be able to access.

The attack surface requires: (1) the deployment must use catalog cluster discovery, (2) the attacker must have permissions to create or modify kubernetes-cluster Resource entities (PR:L), and (3) the backend must possess RBAC permissions to read Kubernetes resources via its in-cluster identity (pod RBAC). The CVSS vector reflects a scope change (S:C) because the vulnerable component (Backstage backend) impacts a different security authority (the Kubernetes cluster). The confidentiality impact is low (C:L) because exposure is limited to resources readable by the backend’s service account, and attack complexity is high (AC:H) due to the specific configuration and permission prerequisites. There is no integrity or availability impact.

Exploitation Scenarios

No public PoC or exploit code is available for CVE-2026-106487. The following attack chain is inferred from the vulnerability class (CWE-441) and the NVD description.

1. Reconnaissance / Target Identification: The attacker identifies a Backstage instance that uses catalog cluster discovery. This can be inferred by observing catalog entities of kind Resource with type kubernetes-cluster, or by interacting with the software catalog UI. The attacker must also determine whether the Backstage backend runs inside a Kubernetes cluster with a service account that has read permissions on cluster resources.

2. Prerequisite Access: The attacker needs permissions to create or modify kubernetes-cluster Resource entities within the catalog. This could be achieved through a compromised developer account, a misconfigured catalog ingestion process, or delegated catalog ownership. The attacker then crafts or modifies a kubernetes-cluster entity with a malicious configuration, such as pointing the cluster endpoint to a controlled address or manipulating metadata that triggers the unsupported authentication mode.

3. Triggering the Flaw: The attacker causes the Backstage backend to process the crafted catalog entity. When the kubernetes-backend plugin performs cluster discovery and attempts to connect to the cluster defined in the entity, it may fall back to using its local in-cluster identity for authentication. The exact trigger depends on the plugin’s authentication mode selection logic, which the description indicates is unsupported. The backend then uses its service account token to authenticate to the local Kubernetes API endpoint.

4. Post-Exploitation Impact: The backend’s in-cluster identity may have RBAC permissions that allow reading Kubernetes resources (pods, secrets, configmaps, etc.) that the attacker cannot directly access. The results of API calls made with this identity could be returned to the attacker through the Backstage interface or API responses. This constitutes an information disclosure vulnerability. The credential itself is not leaked to the attacker’s endpoint, but the data readable by the credential is exposed. The blast radius is limited to the permissions granted to the Backstage backend’s service account within the cluster.

Impact Assessment

The vulnerability has a CVSS 3.1 base score of 3.5, rated Low. The vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N indicates:

• Attack Vector (Network): Exploitation is possible remotely over the network.
• Attack Complexity (High): Success depends on specific deployment configurations (catalog cluster discovery enabled) and the attacker’s ability to create or modify catalog entities.
• Privileges Required (Low): The attacker needs a low-privileged account with catalog entity write permissions.
• User Interaction (None): No user action is required beyond the attacker’s own actions.
• Scope (Changed): The vulnerable Backstage component impacts the Kubernetes cluster, a separate security scope.
• Confidentiality (Low): Limited information disclosure of Kubernetes resources readable by the backend’s service account.
• Integrity (None) and Availability (None): No impact on data integrity or service availability.

Business impact includes potential exposure of sensitive Kubernetes resource metadata or configurations to unauthorized users. The blast radius is confined to clusters where the Backstage backend runs with a service account that has read permissions, and where catalog contributors have excessive entity creation rights. Multi-tenant Backstage deployments with delegated catalog ownership are at higher risk. No public exploit or in-the-wild activity has been reported, and the EPSS score is not yet available.

Detection Guidance

Sigma Rule

title: Backstage Kubernetes Backend Unsupported Catalog Cluster Authentication Attempt
id: 8f2c1a4e-9b3d-4e7f-8a1c-2d5e6f7a8b9c
status: experimental
description: Detects potential exploitation of CVE-2026-106487 via anomalous kubernetes-cluster resource entity creation or modification in Backstage
author: Threat Intelligence
date: 2026-01-01
logsource:
  product: backstage
  service: audit
detection:
  selection:
    event.action:
      - 'catalog.entity.create'
      - 'catalog.entity.update'
    entity.kind: 'Resource'
    entity.type: 'kubernetes-cluster'
  condition: selection
falsepositives:
  - Legitimate catalog management by authorized platform engineers
level: medium
tags:
  - attack.t1078
  - cve.2026-106487

YARA Rule

rule CVE_2026_106487_Backstage_K8s_Cluster_Entity
{
    meta:
        description = "Detects kubernetes-cluster Resource entities in Backstage catalog that may trigger CVE-2026-106487"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-106487"
        severity = "low"
    strings:
        $kind = "kind: Resource" ascii
        $type = "type: kubernetes-cluster" ascii
        $api = "backstage.io/v1alpha1" ascii
        $auth = "authProvider" ascii
        $skip = "skipTLSVerify" ascii
    condition:
        $kind and $type and $api and any of ($auth, $skip)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-106487 Backstage Kubernetes Backend Catalog Cluster Entity Manipulation"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"/api/catalog/entities"; http.request_body; content:"kubernetes-cluster"; http.request_body; content:"kind"; http.request_body; content:"Resource"; reference:cve,2026-106487; classtype:attempted-recon; sid:10000001; rev:1;)

Elastic Detection

sequence by user.name with maxspan=5m
  [any where event.action == "catalog.entity.create" and entity.kind == "Resource" and entity.type == "kubernetes-cluster"]
  [any where event.action == "kubernetes.cluster.connect" and process.name == "backstage-backend"]

Splunk SPL Query

index=backstage sourcetype=backstage:audit
( action="catalog.entity.create" OR action="catalog.entity.update" )
entity_kind="Resource" entity_type="kubernetes-cluster"
| stats count by user, entity_name, src_ip, _time
| where count > 0
| sort - _time

Wazuh OSSEC Rule

<group name="backstage,cve-2026-106487">
  <rule id="100001" level="8">
    <decoded_as>json</decoded_as>
    <field name="event.action">catalog\.entity\.(create|update)</field>
    <field name="entity.kind">Resource</field>
    <field name="entity.type">kubernetes-cluster</field>
    <description>CVE-2026-106487: Potential Backstage catalog kubernetes-cluster entity manipulation for cluster authentication abuse.</description>
    <mitre>
      <id>T1078</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate Mitigations:

   • Restrict catalog entity creation and modification permissions for kubernetes-cluster Resource entities to trusted platform administrators only.
   • Audit existing catalog kubernetes-cluster entities for unexpected or unauthorized entries, especially those pointing to unusual endpoints or with suspicious metadata.
   • Review and minimize RBAC permissions granted to the Backstage backend service account within Kubernetes; enforce least privilege so the in-cluster identity cannot read sensitive resources beyond what is necessary.
   • If catalog cluster discovery is not essential, disable the feature or configure the kubernetes-backend plugin to use explicit, pre-configured authentication modes rather than catalog-supplied credentials.

2. Patch/Upgrade Steps:

   • Upgrade @backstage/plugin-kubernetes-backend to version 0.21.10 or later, which contains the fix for the unsupported authentication mode.
   • After upgrading, verify that the plugin no longer falls back to local in-cluster identity for catalog-supplied cluster endpoints.

3. Long-Term Hardening:

   • Implement strict validation of catalog entity fields, ensuring that authentication-related configurations cannot be influenced by untrusted catalog contributors.
   • Use a dedicated service account for the Backstage backend with minimal RBAC permissions, and avoid cluster-admin or broad read roles.
   • Regularly review catalog ownership and contributor permissions; enforce the principle of least privilege for entity management.
   • Monitor for anomalous catalog changes and Kubernetes API access patterns originating from the Backstage backend using the detection rules provided.

References

• NVD – CVE-2026-106487
• Backstage Security Advisories
• CWE-441: Unintended Proxy or Intermediary ('Confused Deputy')
• MITRE ATT&CK T1078 – Valid Accounts
• Backstage Kubernetes Backend Plugin Documentation