https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 04:00:34 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-106492 <p>Backstage is an open framework for building developer portals. Prior to 0.16.1 and 0.17.8, the @backstage/backend-defaults package is affected by improper preservation of access restrictions during service credential delegation. An external service credential configured with access restrictions (e.g., read-only) could bypass those restrictions by routing requests through plugin delegation paths. This could allow a restricted service to perform operations beyond its intended scope, including write operations on plugins it was restricted to read-only access for. This issue is fixed in versions 0.16.1 and 0.17.8.</p> <p>Backstage is an open framework for building developer portals. Prior to 0.16.1 and 0.17.8, the @backstage/backend-defaults package is affected by improper preservation of access restrictions during service credential delegation. An external service credential configured with access restrictions (e.g., read-only) could bypass those restrictions by routing requests through plugin delegation paths. This could allow a restricted service to perform operations beyond its intended scope, including write operations on plugins it was restricted to read-only access for. This issue is fixed in versions 0.16.1 and 0.17.8.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-106492 https://vulnerability.circl.lu/vuln/ghsa-cq7v-rfgc-5c7v <p><strong>Affected:</strong> npm: @backstage/backend-defaults</p> <p>### Impact</p> <p>An external service credential configured with access restrictions (e.g., read-only) could bypass those restrictions by routing requests through plugin delegation paths. This could allow a restricted service to perform operations beyond its intended scope, including write operations on plugins it was restricted to read-only access for.</p> <p>### Patches</p> <p>Patched in `@backstage/backend-defaults` version `0.17.8`</p> <p>### Workarounds</p> <p>If you&#39;re unable to upgrade immediately:</p> <p>- If practical, replace restricted credentials with separate, purpose-specific unrestricted credentials scoped to trusted consumers. - Restrict network-level access to Backstage backend API endpoints to trusted callers only.</p> <p><strong>Affected:</strong> npm: @backstage/backend-defaults</p> <p>### Impact</p> <p>An external service credential configured with access restrictions (e.g., read-only) could bypass those restrictions by routing requests through plugin delegation paths. This could allow a restricted service to perform operations beyond its intended scope, including write operations on plugins it was restricted to read-only access for.</p> <p>### Patches</p> <p>Patched in `@backstage/backend-defaults` version `0.17.8`</p> <p>### Workarounds</p> <p>If you&#39;re unable to upgrade immediately:</p> <p>- If practical, replace restricted credentials with separate, purpose-specific unrestricted credentials scoped to trusted consumers. - Restrict network-level access to Backstage backend API endpoints to trusted callers only.</p> https://vulnerability.circl.lu/vuln/ghsa-cq7v-rfgc-5c7v