Summary
Backstage has incorrect authorization in search engine permission filtering
Advisory details
Impact
An authenticated Backstage user subject to a DENY policy for search document types could receive search results they were not authorized to view. This affects deployments with permission.enabled: true and an Elasticsearch or OpenSearch search backend.
Patches
- Upgrade
@backstage/plugin-search-backendto 2.1.6 - Upgrade
@backstage/plugin-search-backend-module-elasticsearchto 1.8.7
Workarounds
If you are unable to upgrade immediately:
- Temporarily modify permission policies to use
CONDITIONALdecisions with per-result filtering rather than blanketDENYfor search document types - Restrict Elasticsearch/OpenSearch index access at the cluster level so that the search service account can only reach expected Backstage indices, limiting the blast radius if the authorization bypass is triggered.
References
- https://github.com/advisories/GHSA-9325-vq29-gp3v
- https://github.com/backstage/backstage/security/advisories/GHSA-9325-vq29-gp3v
- https://nvd.nist.gov/vuln/detail/CVE-2026-106562
- https://github.com/backstage/backstage/commit/2d5d3e77d630455d6d48cfa8f31fd3c126fd6f29
- https://github.com/backstage/backstage/releases/tag/v1.54.1
Related vulnerabilities
All Supply chain →- MEDIUMCVE-2026-96628
Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof`
- MEDIUMCVE-2026-58494
Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination
- MEDIUMCVE-2026-102832
JupyterLab: Command link trust prompt in JupyterLab can trust a document other than the one clicked
- MEDIUMCVE-2026-103028
SFTPGo source-side file-pattern filter bypass during copy operations
- HIGHCVE-2026-100352
kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation Path
- CRITICALCVE-2026-77459
Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks