CVE-2026-106457

Undergoing Analysis Undergoing Analysis - In Progress

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-07

Assigner: GitHub, Inc.

Description

Backstage is an open framework for building developer portals. From 0.1.0 until 0.5.0, the @backstage/plugin-auth-backend-module-cloudflare-access-provider package is affected by insufficient audience validation in the cloudflare access auth provider. The Cloudflare Access auth provider verifies a token's signature and team issuer, but affected versions do not verify that the token was issued for the Backstage application. A user holding a valid token for another Access application in the same Cloudflare Zero Trust team may therefore be able to authenticate to Backstage if that token reaches the auth endpoint without the Backstage application's audience already being enforced upstream. Cloudflare Access normally evaluates the protected application before forwarding requests. This issue is fixed in version 0.5.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-07

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-106457

Affected Vendors & Products

Vendor	Product	Version / Range
backstage	backstage	>= 1.26.0, < 1.55.0
@backstage	plugin-auth-backend-module-cloudflare-access-provider	>= 0.1.0, < 0.5.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Executive Summary

This vulnerability affects the @backstage/plugin-auth-backend-module-cloudflare-access-provider package in Backstage versions from 0.1.0 to 0.5.0. It involves insufficient audience validation in the Cloudflare Access auth provider, meaning it does not properly verify if a token was issued specifically for the Backstage application. This could allow a user with a valid token for another Access application in the same Cloudflare Zero Trust team to authenticate to Backstage if the token reaches the auth endpoint without the Backstage application's audience enforced upstream.

Detection Guidance

To detect this vulnerability, check if your Backstage instance uses the affected @backstage/plugin-auth-backend-module-cloudflare-access-provider package version before 0.5.0. Inspect package.json or run npm list @backstage/plugin-auth-backend-module-cloudflare-access-provider to verify the installed version.

Impact Analysis

An attacker with a valid token for another Cloudflare Access application in the same team could gain unauthorized access to Backstage. This could lead to data exposure, unauthorized actions, or potential compromise of sensitive information within the Backstage portal.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Unauthorized access risks data breaches, potentially resulting in legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Update the @backstage/plugin-auth-backend-module-cloudflare-access-provider package to version 0.5.0 or later to address the insufficient audience validation issue.

Hi! I’m here to help you understand CVE-2026-106457. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70