CVE-2026-106562 backstage CVE debrief

Who should care

Defenders responsible for Backstage deployments with permission.enabled: true and an Elasticsearch or OpenSearch search backend should assess exposure and prioritize remediation. This includes operators, platform teams, vulnerability management teams, and security teams who need to review and mitigate the vulnerability. They should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Why it matters

CVE-2026-106562 is an authorization bypass vulnerability in Backstage's search engine permission filtering. Defenders should prioritize remediation, especially in deployments with permission.enabled: true and an Elasticsearch or OpenSearch search backend. The vulnerability allows authenticated users to receive search results they are not authorized to view.

• Authenticated users may receive unauthorized search results
• Requires verification of affected versions and deployments
• Remediation priority for exposed deployments
• Limiting blast radius if authorization bypass is triggered

Technical summary

CVE-2026-106562 is an authorization bypass vulnerability in Backstage's search engine permission filtering. An authenticated user subject to a DENY policy for search document types could receive search results they were not authorized to view. This affects deployments with permission.enabled: true and an Elasticsearch or OpenSearch search backend. The vulnerability allows authenticated users to receive unauthorized search results due to incorrect authorization in search engine permission filtering. Defenders should prioritize upgrading @backstage/plugin-search-backend to 2.1.6 and @backstage/plugin-search-backend-module-elasticsearch to 1.8.7.

Defensive priority

Defenders should prioritize upgrading @backstage/plugin-search-backend to 2.1.6 and @backstage/plugin-search-backend-module-elasticsearch to 1.8.7. If immediate upgrade is not possible, temporarily modify permission policies to use CONDITIONAL decisions with per-result filtering rather than blanket DENY for search document types, or restrict Elasticsearch/OpenSearch index access at the cluster level.

Recommended defensive actions

• Upgrade @backstage/plugin-search-backend to 2.1.6
• Upgrade @backstage/plugin-search-backend-module-elasticsearch to 1.8.7
• Temporarily modify permission policies to use CONDITIONAL decisions with per-result filtering
• Restrict Elasticsearch/OpenSearch index access at the cluster level
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The source corpus provides details on the vulnerability, including its impact, patches, and workarounds. However, it does not provide information on exploitation or specific victims. The vulnerability has been identified in Backstage's search engine permission filtering, allowing authenticated users to receive search results they are not authorized to view. This affects deployments with permission.enabled: true and an Elasticsearch or OpenSearch search backend.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.