CVE-2026-106562: @backstage/plugin-search-backend Authorization Bypass in Search Engine
Summary
CVE-2026-106562: Backstage has incorrect authorization in search engine permission filtering. Affects @backstage/plugin-search-backend versions < 2.1.6. Fixed in 2.1.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @backstage/plugin-search-backend package is a core component of the Backstage platform, which is designed to facilitate the development of developer portals. It provides search functionalities that allow users to query various document types. This package, when integrated with Elasticsearch or OpenSearch, enables efficient searching across multiple data sources. However, it has been found to have an authorization flaw that could expose sensitive search results to unauthorized users.
Vulnerability Detail
The vulnerability arises from incorrect authorization handling in the search engine permission filtering. Specifically, an authenticated user who is subject to a 'DENY' policy for certain search document types may still receive search results that they are not authorized to view. This issue is particularly critical for deployments where permission management is enabled, as it can lead to unauthorized access to sensitive information. The flaw is rooted in the way permissions are enforced, allowing for potential data leaks.
How To Fix
Minimum fixed version
2.1.6
This is the first release that contains the fix.
npm install @backstage/plugin-search-backend@2.1.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing the following workarounds:
- Temporarily modify permission policies to use 'CONDITIONAL' decisions with per-result filtering instead of blanket 'DENY' for search document types.
- Restrict Elasticsearch/OpenSearch index access at the cluster level to ensure that the search service account can only access expected Backstage indices, thereby limiting the potential impact of the authorization bypass.
Conclusion
In summary, CVE-2026-106562 is a moderate severity vulnerability affecting the @backstage/plugin-search-backend package, which can lead to unauthorized access to search results. It is crucial to upgrade to the patched versions or implement the suggested workarounds to mitigate the risk.
See every vulnerability recorded for @backstage/plugin-search-backend →
FAQ
CVE-2026-106562 is a vulnerability in the @backstage/plugin-search-backend package that allows unauthorized users to access search results they should not be able to view.
If your application uses the affected versions of the @backstage/plugin-search-backend and has permission management enabled, unauthorized users may gain access to sensitive search results.
You can implement temporary workarounds such as modifying permission policies or restricting index access at the cluster level.
The patched version for @backstage/plugin-search-backend is 2.1.6, and for @backstage/plugin-search-backend-module-elasticsearch, it is 1.8.7.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities using just your package-lock.json file. You can also check your application against vulnerabilities using the Vulert playground without any signup.
