CVE-2026-106457

Medium

Advisory

Published 7 Oct 2026In the index since 8 Oct 2026

Backstage: Insufficient audience validation in the Cloudflare Access auth provider

Carried by container images the latest versions of 2 of 18,117 indexed charts deploy, on 2 images.

Affected package	Affected versions	Fixed in	Images
@backstage/plugin-auth-backend-module-cloudflare-access-providernpm	0.4.13, 0.4.16	0.5.0	2

2 by stars

Chart

Latest

Affected images

Radar Score

backstagerhdh-chart

1 of the 2 container images this version deploys carry CVE-2026-106457.

Container image	Digest	Package	Fixed in
quay.io/rhdh/rhdh-hub-rhel9 :latest	e992092fcc9b	@backstage/plugin-auth-backend-module-cloudflare-access-provider@0.4.13	0.5.0

2,039

devportalveecode-platform-next

1 container image this version deploys carries CVE-2026-106457.

Container image	Digest	Package	Fixed in
veecode/devportaldigest-pinned	e5c84f744994	@backstage/plugin-auth-backend-module-cloudflare-access-provider@0.4.16	0.5.0

—

2 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
veecode/devportal	e5c84f744994	@backstage/plugin-auth-backend-module-cloudflare-access-provider@0.4.16	0.5.0	1
quay.io/rhdh/rhdh-hub-rhel9 :latest	e992092fcc9b	@backstage/plugin-auth-backend-module-cloudflare-access-provider@0.4.13	0.5.0	1