CVE-2026-106497

Executive Summary

CVE-2026-106497 is an inconsistent permission evaluation vulnerability in the @backstage/plugin-catalog-backend package of Backstage, an open framework for building developer portals. Prior to version 3.9.1, deployments that rely on value-based catalog permission conditions as a confidentiality boundary may allow an authenticated user to receive catalog entity data that policy authors intended to restrict. The impact is a low-severity confidentiality breach (CVSS 4.3, C:L) requiring authenticated access, but it is significant for organizations that treat catalog permissions as a data-access control plane.

Technical Analysis

CWE-178 is "Improper Handling of Case Sensitivity." In the context of the affected Backstage catalog backend, the flaw is described as "inconsistent catalog property permission evaluation." The vulnerability class indicates that the permission-checking logic applied to catalog entity properties did not evaluate inputs consistently across all code paths or comparison operations.

The relevant mechanism is value-based catalog permission conditions. Backstage's permission framework allows policy authors to define conditions that restrict access to catalog entities based on the value of entity properties (for example, matching a field such as an owner, namespace, or annotation). When such a condition is used as a confidentiality boundary, the policy author intends that only matching entity data is returned to a given user.

The inconsistency in evaluation means that at least one code path performs the property/permission comparison differently from another — a classic case-sensitivity or normalization mismatch. A value that fails (or passes) a check in one path may be treated differently in the comparison actually used to filter returned entity data. As a result, an authenticated user whose policy should restrict certain catalog entity data can receive entity data that the policy was intended to withhold.

The flaw is confined to the catalog backend package's permission evaluation for property conditions. It is not an authentication bypass; it requires an already-authenticated principal (PR:L). There is no stated impact on integrity or availability (I:N/A:N), and the confidentiality impact is bounded to low (C:L). No public proof-of-concept, Nuclei template, or exploit code is available.

The NVD description does not enumerate specific functions, classes, endpoints, or parameter names. This report therefore describes the vulnerability at the vulnerability-class level and does not assert internal implementation identifiers beyond those named in the description itself (the package @backstage/plugin-catalog-backend, "value-based catalog permission conditions," "catalog entity data," and the fixed version 3.9.1).

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (CWE-178, inconsistent permission evaluation) and the NVD description. It does not assert specific function names, endpoints, or parameters, none of which are provided in the source data.

1. Reconnaissance / target identification. An attacker identifies a Backstage deployment (developer portal) that (a) runs @backstage/plugin-catalog-backend prior to 3.9.1 and (b) uses value-based catalog permission conditions as a confidentiality boundary. This requirement is organizational knowledge or inference: the attacker must know or guess that catalog property conditions are being relied upon to restrict entity data for the signed-in user's role.

2. Authentication and precondition. The attacker authenticates to the developer portal as a legitimate but low-privilege user (PR:L). No elevated privileges or user interaction are required (UI:N).

3. Triggering the flaw class. The attacker requests catalog entity data through the normal, authenticated catalog interface. Because permission evaluation on catalog properties is inconsistent, the value-based condition that is supposed to restrict which entity data the user may see is not applied uniformly to the data actually returned. A property value differing only in case, or otherwise handled inconsistently between the policy check and the data-filtering path, can cause the restriction to be bypassed, and entity data the policy author intended to restrict is returned to the requester.

4. Post-exploitation impact. The user obtains catalog entity data (developer-portal inventory data) they were not intended to see. The confidentiality impact is limited (C:L): exposure of catalog metadata rather than credentials, code execution, or write access. There is no integrity or availability impact, and the CVSS scope is unchanged (S:U).

Impact Assessment

The CVSS 3.1 base score is 4.3 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. The subscores show:

• Network attack vector and low attack complexity: an authenticated attacker can attempt exploitation remotely with little specialized effort.
• Low privileges required and no user interaction: any authenticated portal user is a potential actor.
• Unchanged scope, low confidentiality only, no integrity or availability impact: the flaw leaks catalog entity data but does not allow modification or denial of service.

Business impact concentrates on organizations that use value-based catalog permission conditions as an access-control boundary — for example, restricting which teams can see which catalog entities. In such deployments, inconsistent evaluation undermines the confidentiality guarantee for catalog metadata, which can include internal service ownership, system topology, and repository/annotation details used for reconnaissance in further attacks. The blast radius is limited to catalog entity data visible through the affected backend and to those policy configurations that depend on value-based property conditions. EPSS is not yet scored by FIRST.org, and there is no evidence of exploitation in the wild or inclusion in CISA KEV.

Detection Guidance

Sigma Rule

title: Backstage Catalog Permission Condition Bypass Attempts (CVE-2026-106497)
id: 9a3f6c1e-0d2b-4a77-9c5e-1b2d4f6a8c01
status: experimental
description: Detects anomalous catalog entity access patterns consistent with inconsistent value-based catalog permission evaluation in @backstage/plugin-catalog-backend prior to 3.9.1.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-106497
author: valtersit.com
date: 2026/01/01
logsource:
  product: backstage
  service: catalog
detection:
  selection_path:
    http.url|contains: '/api/catalog/entities'
  selection_user:
    user.name|exists: true
  selection_anomaly:
    - http.status: 200
    - action|contains: 'catalog.entity.read'
  condition: selection_path and selection_user and selection_anomaly
falsepositives:
  - Legitimate broad catalog reads by administrators
level: low
tags:
  - attack.t1213
  - cve.2026.106497

YARA Rule

rule CVE_2026_106497_Backstage_Catalog_Permission_Bypass
{
    meta:
        author = "valtersit.com"
        description = "Detects references to Backstage catalog backend versions prior to 3.9.1 and value-based catalog permission conditions in source/config artifacts associated with CVE-2026-106497."
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-106497"
        date = "2026-01-01"
        cve = "CVE-2026-106497"

    strings:
        $pkg = "@backstage/plugin-catalog-backend" ascii wide
        $cond = "catalog permission" ascii wide nocase
        $cond2 = "value-based" ascii wide nocase
        $cond3 = "permission condition" ascii wide nocase
        $vers = /"version"\s*:\s*"3\.[0-8]\.[0-9]+"/ ascii

    condition:
        $pkg and ($cond or $cond2 or $cond3) and $vers
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-106497 Backstage Catalog Permission Condition Bypass Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/api/catalog/entities"; http.header; content:"Authorization"; reference:cve,CVE-2026-106497; classtype:attempted-recon; sid:2026106497; rev:1;)

Elastic Detection

sequence by user.name
  [ http where url.path : "/api/catalog/entities" and http.response.status_code == 200 ]
  [ http where url.path : "/api/catalog/entities" and http.response.status_code == 200 ]

Splunk SPL Query

index=backstage sourcetype=backstage:catalog
| search uri_path="/api/catalog/entities" status=200
| stats count min(_time) as first_seen max(_time) as last_seen values(entity_ref) as entities by user, src_ip
| where count > 25
| sort - count

Wazuh OSSEC Rule

<group name="backstage,cve-2026-106497,">
  <rule id="202610497" level="7">
    <decoded_as>json</decoded_as>
    <field name="uri_path">/api/catalog/entities</field>
    <field name="status">200</field>
    <description>CVE-2026-106497: Possible Backstage catalog entity access consistent with permission condition bypass</description>
    <mitre>
      <id>T1213</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

• Do not rely on value-based catalog permission conditions as a sole confidentiality boundary for sensitive catalog entity data until the package is upgraded. Treat catalog entity metadata as potentially visible to any authenticated user.
• Restrict catalog backend exposure to trusted networks or authenticated populations, limiting the principal set (PR:L) that can attempt exploitation.
• Monitor catalog entity access logs for anomalous read patterns from low-privilege or unexpected users, using the detection content above.

2. Patch / upgrade steps:

• Upgrade @backstage/plugin-catalog-backend to version 3.9.1, which the NVD description states fixes the issue. No vendor advisory URL, patch reference, or workaround is available in the provided data; confirm availability against the vendor's release channels before relying on it.
• After upgrade, re-validate that value-based catalog permission conditions enforce the intended confidentiality boundary.

3. Long-term hardening:

• Adopt a defense-in-depth model in which value-based property conditions are not the only control protecting sensitive catalog data.
• Add automated tests that exercise permission condition evaluation across case variants and normalization edge cases (CWE-178 class defects) to catch inconsistent evaluation before deployment.
• Maintain an inventory of catalog permission policies that act as confidentiality boundaries and review them whenever the catalog backend is updated.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-106497
• CWE-178 (Improper Handling of Case Sensitivity): https://cwe.mitre.org/data/definitions/178.html
• Backstage project (open framework for building developer portals): https://backstage.io
• Backstage catalog backend package documentation (permissions and catalog): https://backstage.io/docs
• CISA Known Exploited Vulnerabilities catalog: not applicable — CVE-2026-106497 is not listed in CISA KEV, and no exploit-in-the-wild or threat-actor campaign evidence was available at time of writing.