Backend defaults: Backstage: Improper preservation of access restrictions during service credential delegation (CVE-2026-106492)

The vulnerability in @backstage/backend-defaults involves improper preservation of access restrictions when service credentials are delegated through plugin paths. Specifically, an external service credential that is intended to have restricted access (such as read-only) can bypass these restrictions by routing requests through plugin delegation, enabling it to perform unauthorized operations beyond its intended scope, including write operations. This flaw affects versions prior to 0.17.8 and is addressed by an official patch in version 0.17.8.

An attacker or service using a restricted external credential could escalate privileges by bypassing access controls, potentially modifying data or configurations in plugins that should have been read-only. This elevates the risk of unauthorized changes and data integrity issues within the Backstage environment.

An official patch is available in @backstage/backend-defaults version 0.17.8 and should be applied to remediate this vulnerability. If immediate upgrade is not possible, it is recommended to replace restricted credentials with separate, purpose-specific unrestricted credentials scoped to trusted consumers. Additionally, network-level access to Backstage backend API endpoints should be restricted to trusted callers only.