CVE-2026-106457: Backstage: Insufficient audience validation in the Cloudflare Access auth provider

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-06 · updated 2026-10-27
Weakness: CWE-287

Description

Backstage is an open framework for building developer portals. From 0.1.0 until 0.5.0, the @backstage/plugin-auth-backend-module-cloudflare-access-provider package is affected by insufficient audience validation in the cloudflare access auth provider. The Cloudflare Access auth provider verifies a token's signature and team issuer, but affected versions do not verify that the token was issued for the Backstage application. A user holding a valid token for another Access application in the same Cloudflare Zero Trust team may therefore be able to authenticate to Backstage if that token reaches the auth endpoint without the Backstage application's audience already being enforced upstream. Cloudflare Access normally evaluates the protected application before forwarding requests. This issue is fixed in version 0.5.0.

Affected products

backstage: from 1.26.0 before 1.55.0 — fixed in 1.55.0
Linuxfoundation Backstage/Plugin-Auth-Backend-Module-Cloudflare-Access-Provider: from 0.1.0 before 0.5.0 — fixed in 0.5.0
backstage: from 1.26.0, < 1.55.0
@backstage plugin-auth-backend-module-cloudflare-access-provider: from 0.1.0, < 0.5.0

How to fix

Upgrade to a fixed version: backstage 1.55.0; Linuxfoundation Backstage/Plugin-Auth-Backend-Module-Cloudflare-Access-Provider 0.5.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-106457 or the next vulnerability affects your stack