« Volver al listado

CVE-2026-106562

Estado: En análisisMedia (4.3)—

Backstage es un framework abierto para crear portales de desarrolladores. Antes de 2.1.6 en @backstage/plugin-search-backend y de 1.8.7 en @backstage/plugin-search-backend-module-elasticsearch, el filtrado de permisos del motor de búsqueda podía devolver documentos denegados por la política. Un usuario autenticado de Backstage sujeto a una política DENY para tipos de documentos de búsqueda podría recibir resultados no autorizados en despliegues con permission.enabled establecido en true y un backend de Elasticsearch u OpenSearch. Este problema está corregido en @backstage/plugin-search-backend 2.1.6 y @backstage/plugin-search-backend-module-elasticsearch 1.8.7.

Traducción automática del texto original de NVD (en inglés).

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Autenticado en Backstage (PR:L) accede remotamente a documentos denegados por política DENY, obteniendo datos no autorizados mediante bypass de permisos en backend de búsqueda.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementApplication Developer GuidanceActive Directory ConfigurationVulnerability ScanningUser TrainingUser Account Management

Tecnologías afectadas (2)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Backstage — Plugin Search BackendAIBackstage — Plugin Search Backend Module ElasticsearchAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-106562",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-106562",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-10-07T16:14:40.675570Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "backstage",
          "product": "backstage",
          "versions": [
            {
              "status": "affected",
              "version": "< 1.54.1"
            }
          ]
        },
        {
          "vendor": "@backstage",
          "product": "plugin-search-backend",
          "versions": [
            {
              "status": "affected",
              "version": "< 2.1.6"
            }
          ]
        },
        {
          "vendor": "@backstage",
          "product": "plugin-search-backend-module-elasticsearch",
          "versions": [
            {
              "status": "affected",
              "version": "< 1.8.7"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-10-07T15:17:17.677",
  "references": [
    {
      "url": "https://github.com/backstage/backstage/commit/2d5d3e77d630455d6d48cfa8f31fd3c126fd6f29",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/backstage/backstage/releases/tag/v1.54.1",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/backstage/backstage/security/advisories/GHSA-9325-vq29-gp3v",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Undergoing Analysis",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-754"
        },
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Backstage is an open framework for building developer portals. Prior to 2.1.6 in @backstage/plugin-search-backend and 1.8.7 in @backstage/plugin-search-backend-module-elasticsearch, search engine permission filtering could return documents denied by policy. An authenticated Backstage user subject to a DENY policy for search document types could receive unauthorized results in deployments with permission.enabled set to true and an Elasticsearch or OpenSearch backend. This issue is fixed in @backstage/plugin-search-backend 2.1.6 and @backstage/plugin-search-backend-module-elasticsearch 1.8.7."
    }
  ],
  "lastModified": "2026-10-07T17:16:51.323",
  "sourceIdentifier": "security-advisories@github.com"
}