Backstage Cloudflare Access auth provider: Insufficient audience validation
Summary
The Cloudflare Access auth provider of the Backstage plugin @backstage/plugin-auth-backend-module-cloudflare-access-provider does not check whether a token was issued for the Backstage application. A user with a valid token for another Cloudflare Access application in the same Zero Trust team may be able to sign in to Backstage if that token reaches the auth endpoint without the audience being enforced upstream. The impact depends on the sign-in resolver and the permissions of the mapped identity.
Affected
- @backstage/plugin-auth-backend-module-cloudflare-access-provider >= 0.1.0, < 0.5.0
- Backstage core per CVE record: >= 1.26.0, < 1.55.0
Fixed in
- @backstage/plugin-auth-backend-module-cloudflare-access-provider 0.5.0 or later
- Included in Backstage 1.55.0
Workaround
- Restrict access to the Backstage auth endpoint to the intended Cloudflare Access application
- Use a custom authenticator that validates the application audience
- Disable the provider until the patched package is deployed
Exploitation
- No exploitation reported by the vendor; no public proof of concept found
- CISA SSVC: exploitation none, automatable no, technical impact total
Our recommendation
- Check whether Backstage uses the cfaccess provider and whether several Access applications share the same Cloudflare team
- Upgrade to plugin version 0.5.0 or Backstage 1.55.0 or later, and set auth.providers.cfaccess.audience to the Audience (AUD) tag (breaking change)
- Until then, restrict the auth endpoint or disable the provider, and review the sign-in resolver and permissions
- Verify the CVSS score on NVD, as sources list 6.8 and 8.1
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Backstage GitHub Security Advisory GHSA-q333-f498-w2x7 github.com
- Fix commit ed9034c github.com
- Backstage v1.55.0 release github.com
- Backstage v1.55.0 release notes backstage.io
- OSV CVE-2026-106457 osv.dev
- GitHub Advisory GHSA-q333-f498-w2x7 github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 20:41.
Original description (NVD)
Backstage is an open framework for building developer portals. From 0.1.0 until 0.5.0, the @backstage/plugin-auth-backend-module-cloudflare-access-provider package is affected by insufficient audience validation in the cloudflare access auth provider. The Cloudflare Access auth provider verifies a token's signature and team issuer, but affected versions do not verify that the token was issued for the Backstage application. A user holding a valid token for another Access application in the same Cloudflare Zero Trust team may therefore be able to authenticate to Backstage if that token reaches the auth endpoint without the Backstage application's audience already being enforced upstream. Cloudflare Access normally evaluates the protected application before forwarding requests. This issue is fixed in version 0.5.0.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.