CVE-2026-106495

Executive Summary

CVE-2026-106495 is an improper access control vulnerability (CWE-284) in the @backstage/backend-defaults npm package, a core component of the Backstage open-source developer portal framework. Prior to version 0.17.8, an authenticated user could invoke backend actions that an operator had explicitly excluded through action configuration, effectively bypassing operator-defined action restrictions. The vulnerability carries a CVSS 3.1 base score of 4.3 (Medium), reflecting a low-integrity impact with no confidentiality or availability loss; the integrity impact remains bounded because existing action permissions and downstream authorization controls continue to be enforced.

Technical Analysis

Backstage is an open framework for building developer portals, and the @backstage/backend-defaults package provides default backend service implementations, including the action registry and invocation plumbing used by the Backstage backend system. Actions in Backstage are discrete units of backend work that can be triggered through backend APIs. Administrators can configure which actions are permitted or excluded, providing a governance boundary over what a given backend deployment will execute.

CVE-2026-106495 concerns improper access control in backend action invocation. According to the NVD description, "Prior to 0.17.8, the @backstage/backend-defaults package is affected by improper access control in backend action invocation. An authenticated user could invoke actions that an operator had excluded through action configuration." In other words, the exclusion list enforced at the configuration layer was not fully honored at the invocation layer: a user who already holds valid credentials and satisfies authentication requirements could still cause excluded actions to be invoked.

The CWE classification is CWE-284 (Improper Access Control), which is the appropriate broad category for a failure to enforce an access-control policy. The specific enforcement gap — whether it stemmed from an ordering issue in permission checks, a divergence between the configuration-consumption path and the invocation path, or a default-allow fallback for actions absent from the exclusion set — is not detailed in the available NVD description. Consequently, no specific function names, class names, endpoints, or parameter names are asserted here; the analysis remains at the vulnerability-class and policy-enforcement layer.

Two mitigating design properties are explicitly stated in the source data. First, "Existing action permissions and downstream authorization remain enforced," meaning the bypass does not grant a user capabilities beyond what their identity and the underlying action permissions already allow — it only defeats the operator's supplementary exclusion configuration. Second, the required privilege level is Low (PR:L) with Network attack vector (AV:N), reflecting that the actor must already be an authenticated user with a valid account. The scope is Unchanged (S:U) and user interaction is None (UI:N).

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N yields 4.3, indicating no confidentiality impact (C:N) and no availability impact (A:N), with only a partial integrity impact (I:L) — consistent with the ability to execute a bounded set of operations that were intended to be disabled but that remain subject to downstream authorization.

Exploitation Scenarios

No public proof-of-concept, Nuclei template, or exploit code is associated with this CVE. The attack chain below is therefore inferred strictly from the vulnerability class (improper access control in action invocation) and the NVD description. No specific action identifiers, API paths, or parameter names are fabricated.

1. Reconnaissance / target identification. The attacker identifies a Backstage deployment running @backstage/backend-defaults at a version earlier than 0.17.8. Because Backstage portals are typically internally exposed to engineering organizations, reconnaissance often assumes the attacker already has a foothold via a legitimate developer account, contractor credential, or a compromised identity.

2. Authentication. The attacker authenticates to the Backstage instance as a valid user. The CVSS privilege-required value of PR:L and the description ("An authenticated user") confirm that authentication is a prerequisite; there is no unauthenticated path described.

3. Triggering the flaw class. With an authenticated session, the attacker invokes a backend action that the operator has listed as excluded in action configuration. Because the pre-0.17.8 enforcement path fails to honor the exclusion set at invocation time, the request to execute the excluded action is not blocked by the exclusion mechanism. The attack is a control-bypass at the policy-enforcement boundary, not a memory-safety or injection primitive.

4. Post-exploitation impact. The excluded action runs, subject to the constraints stated in the advisory: "Existing action permissions and downstream authorization remain enforced." This means the effect is bounded by what the invoking principal is otherwise authorized to do. The impact is therefore integrity-limited (I:L): the operator's intended reduction of the backend's action surface is defeated, potentially exposing functionality (for example, administrative or maintenance actions that the operator had deliberately disabled) that was never meant to be reachable through normal invocation. The narrow blast radius explains the absence of confidentiality and availability impacts in the CVSS vector.

Because the description is sparse, any claim of privilege escalation to full administrative control, lateral movement, or remote code execution would be speculative and is not made here.

Impact Assessment

The business impact of CVE-2026-106495 is moderate and configuration-dependent. The core consequence is the failure of an administrative control: operators who rely on action exclusion configuration as a governance or hardening boundary cannot rely on it in affected versions. Organizations that exclude sensitive or high-impact actions precisely because their downstream authorization is coarse, or because the actions are operationally sensitive, are most exposed. The CVSS subscores quantify the bounds: Network vector (AV:N) with Low complexity (AC:L) means the bypass is straightforward for an authenticated user; Low privileges (PR:L) and no user interaction (UI:N) mean it can be performed directly with a standard account; Unchanged scope (S:U) means the vulnerable component's authority boundary is preserved; and C:N/I:L/A:N means no loss of confidentiality or availability, with only limited integrity impact.

Blast radius is limited to the Backstage backend deployment in scope and to the actions for which exclusion was configured and for which downstream authorization does not independently block the invoking principal. Environments that do not use action exclusions, or that enforce equivalent restrictions through action permissions and downstream authorization alone, see little practical change in effective security posture. Environments that treat exclusion configuration as a security-relevant control should treat their assumption as invalid until upgraded. No evidence of in-the-wild exploitation exists; EPSS has not yet assigned a score, and the CVE is not in CISA KEV.

Detection Guidance

Because no PoC or exploit artifact is public, detections target the behavioral signature of invoking operator-excluded backend actions by authenticated users. Rules below use generic action-invocation telemetry and should be tuned to the local action names configured in each deployment.

Sigma Rule

title: Backstage Excluded Backend Action Invocation by Authenticated User
id: 3f9c2a14-7b6e-4d21-9c8a-1e5b7f0d2c33
status: experimental
description: Detects invocation of backend actions that operators have excluded via action configuration in Backstage @backstage/backend-defaults before 0.17.8 (CVE-2026-106495).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-106495
author: valtersit.com
date: 2026/01/01
logsource:
  product: backstage
  service: backend
detection:
  selection_event:
    event.action|contains: 'action'
  selection_result:
    event.outcome: 'success'
    backstage.action.excluded: true
  filter_service_accounts:
    user.name|endswith: '-bot'
  condition: selection_event and selection_result and not filter_service_accounts
falsepositives:
  - Legitimate administrative maintenance windows where exclusions are temporarily lifted
  - Misconfigured action exclusion lists
level: medium
tags:
  - attack.t1078
  - cve.2026-106495

YARA Rule

rule CVE_2026_106495_Backstage_Excluded_Action_Invocation
{
    meta:
        description = "Detects references to excluded backend action invocation handling in Backstage backend-defaults logs or artifacts associated with CVE-2026-106495"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-106495"
        cve = "CVE-2026-106495"

    strings:
        $pkg = "@backstage/backend-defaults"
        $excl1 = "excludedActions" ascii nocase
        $excl2 = "action configuration" ascii nocase
        $inv1 = "invoke" ascii nocase
        $ver = "0.17." ascii

    condition:
        $pkg and 1 of ($excl*) and $inv1
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-106495 Backstage Excluded Backend Action Invocation Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/api/"; content:"action"; nocase; http.header; content:"Authorization|3a|"; nocase; threshold:type threshold, track by_src, count 10, seconds 60; classtype:attempted-user; reference:cve,2026-106495; sid:2026106495; rev:1;)

Elastic Detection

sequence by user.name with maxspan=2m
  [ authentication where event.outcome == "success" ]
  [ any where event.action == "backend_action_invocation" and
      backstage.action.excluded == true and
      event.outcome == "success" ]

Splunk SPL Query

index=backstage sourcetype=backstage:backend action_invocation=*
| eval excluded=coalesce(action_excluded, "false")
| where excluded="true" AND user!=""
| stats count values(action_name) as actions by user, src_ip
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="backstage,cve-2026-106495,">
  <rule id="106495" level="8">
    <decoded_as>json</decoded_as>
    <field name="event.action">backend_action_invocation</field>
    <field name="action.excluded">true</field>
    <field name="event.outcome">success</field>
    <description>CVE-2026-106495: Authenticated user invoked an operator-excluded Backstage backend action</description>
    <mitre>
      <id>T1078</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations.

   • Verify whether the deployment relies on action exclusion configuration as a security control. If not, practical exposure is limited, because "existing action permissions and downstream authorization remain enforced."
   • For deployments that do rely on exclusions, strengthen the compensating layer: tighten action permissions and downstream authorization so that even if exclusion enforcement fails, the invoking principal cannot perform unintended work.
   • Review audit logs for successful invocations of actions that are listed as excluded, and investigate the originating identities.
   • Where feasible, restrict network reachability to the Backstage backend to trusted internal networks and users, reducing the pool of authenticated principals who can attempt the bypass.

2. Patch / upgrade steps.

   • Upgrade @backstage/backend-defaults to version 0.17.8 or later, per the advisory, which states the issue "is fixed in version 0.17.8."
   • Update the dependency tree in every affected Backstage application and re-run the build; confirm the resolved version of @backstage/backend-defaults in the lockfile.
   • Redeploy and re-validate that excluded actions are no longer invocable.
   • Note: no vendor patch reference, commit hash, or advisory URL was supplied in the source data, and no patch source is confirmed by tracked sources (0/4).

3. Long-term hardening.

   • Do not treat configuration-time exclusion lists as a sole authorization boundary; layer them with action permissions and downstream authorization, which the advisory confirms remain enforced.
   • Adopt continuous dependency monitoring for Backstage packages and alert on advisory updates affecting @backstage/backend-defaults.
   • Enforce least privilege for developer portal identities so that downstream authorization independently constrains the action surface.
   • Maintain auditable, immutable logs of backend action invocations, including the invoking principal and exclusion status, to support detection and response.

References

• NVD — CVE-2026-106495: https://nvd.nist.gov/vuln/detail/CVE-2026-106495
• Backstage project documentation and release notes for @backstage/backend-defaults (advisory states fix in 0.17.8)
• CWE-284: Improper Access Control — https://cwe.mitre.org/data/definitions/284.html
• FIRST.org EPSS (not yet scored for CVE-2026-106495): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-106495 not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No evidence of in-the-wild exploitation, public proof-of-concept, exploit code, or named threat actor campaigns was identified in the source data. EPSS has not yet scored this CVE, and it is not present in CISA KEV.