CVE-2026-106457

Backstage is an open framework for building developer portals. From 0.1.0 until 0.5.0, the @backstage/plugin-auth-backend-module-cloudflare-access-provider package is affected by insufficient audience validation in the cloudflare access auth provider. The Cloudflare Access auth provider verifies a token's signature and team issuer, but affected versions do not verify that the token was issued for the Backstage application. A user holding a valid token for another Access application in the same Cloudflare Zero Trust team may therefore be able to authenticate to Backstage if that token reaches the auth endpoint without the Backstage application's audience already being enforced upstream. Cloudflare Access normally evaluates the protected application before forwarding requests. This issue is fixed in version 0.5.0.

• CWE-287

• https://github.com/backstage/backstage/commit/ed9034cacd9def3b3674f0a764fe992f751e204d
• https://github.com/backstage/backstage/releases/tag/v1.55.0
• https://github.com/backstage/backstage/security/advisories/GHSA-q333-f498-w2x7

Published

Oct 6, 2026

Last Modified

Oct 7, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-106451yawkat LZ4 Java provides LZ4 compression for Java. From 1.7.…7.3
• CVE-2026-106452yawkat LZ4 Java provides LZ4 compression for Java. Prior to …5.3
• CVE-2026-106453yawkat LZ4 Java provides LZ4 compression for Java. Prior to …5.3
• CVE-2026-106454Twisted is an event-based framework for internet application…4.3
• CVE-2026-106455Backstage is an open framework for building developer portal…7.7
• CVE-2026-106456Backstage is an open framework for building developer portal…4.8
• CVE-2026-106458Backstage is an open framework for building developer portal…6.5
• CVE-2026-106459Backstage is an open framework for building developer portal…8.5
• CVE-2026-10646Zephyr's BSD-sockets getaddrinfo() implementation (subsys/ne…7.4
• CVE-2026-106460Backstage is an open framework for building developer portal…6.8
• CVE-2026-106461Backstage is an open framework for building developer portal…4.3
• CVE-2026-106462Backstage is an open framework for building developer portal…6.4