Vulnerability GHSA-cq7v-rfgc-5c7v

High Risk

8 days ago

Backstage: Improper preservation of access restrictions during service credential delegation

0.0.0-nightly-20220811024336 - 0.17.7

Summary

Backstage: Improper preservation of access restrictions during service credential delegation

Details

Impact

An external service credential configured with access restrictions (e.g., read-only) could bypass those restrictions by routing requests through plugin delegation paths. This could allow a restricted service to perform operations beyond its intended scope, including write operations on plugins it was restricted to read-only access for.

Patches

Patched in @backstage/backend-defaults version 0.17.8

Workarounds

If you're unable to upgrade immediately:

If practical, replace restricted credentials with separate, purpose-specific unrestricted credentials scoped to trusted consumers.
Restrict network-level access to Backstage backend API endpoints to trusted callers only.