OpenChoreo Backstage backend: hardcoded auth bypass exposes /api/* to unauthenticated callers

Impact

The Backstage backend shipped with backend.auth.dangerouslyDisableDefaultAuthPolicy and the guest provider's dangerouslyAllowOutsideDevelopment flag hardcoded to true, so every /api/* route answered without authentication. Anyone who can reach the portal can read the full software catalog and scaffolder logs - which on a cluster platform routinely carry cluster names, namespaces, repository URLs and build output - and can create or delete catalog locations, which corrupts the inventory the platform uses to place and track workloads. On a fleet where the developer portal is the front door for scheduling jobs onto GPU nodes, that is an unauthenticated read of how the cluster is laid out plus write access to its registry of deployable components. Confidentiality is the primary loss; integrity is limited to catalog state, not to running workloads directly.

Who can reach it

Anyone who can make an HTTP request to the OpenChoreo Backstage backend - no credentials, no user account, no guest login step. Exposure is whatever the portal is exposed to: cluster-internal only if it is kept behind an ingress with its own auth, or the whole network/internet if it is published as most developer portals are.

What to do

Upgrade the OpenChoreo Backstage plugins to 1.0.4, 1.1.4 or 1.2.1 depending on the branch in use, then redeploy/restart the Backstage backend pod - no node drain or host reboot is involved. Until the upgrade lands, put the portal behind an authenticating proxy or restrict ingress to trusted networks, and treat catalog entries and locations created while the flaw was live as untrusted. The advisory does not state whether exploitation leaves a distinguishable trace, so review scaffolder and catalog activity rather than assuming none occurred.

References

Related entries

• Ceph RGW (SigV4 signature verifier): Anyone handed a single presigned PUT URL gets more authority than whoever signedNCVD-2026-039-ceph-rgw-sigv4-signature-verifie · Ceph RGW (SigV4 signature verifier)High
• Ceph MON (config-key store, MMonSubscribe handler): MULTI-TENANT ISOLATION AND HOST COMPROMISE: one craftedNCVD-2026-041-ceph-mon-config-key-store-mmonsu · Ceph MON (config-key store, MMonSubscribe handler)High
• Ceph MON (ceph-mon): The monitor accepts pool create/delete and snapshot operations from any authenticated user thatCVE-2018-10861 · Ceph MON (ceph-mon)High
• GlusterFS (brick, gfs3_mknod_req): A crafted mknod RPC traverses out of the volume and writes a file anywhere the brickCVE-2018-10926 · GlusterFS (brick, gfs3_mknod_req)High
• Cisco IOS XE MACsec Key Agreement (MKA over EAP-TLS): A logic error in MKA over EAP-TLS lets an unauthenticatedCVE-2018-15372 · Cisco IOS XE MACsec Key Agreement (MKA over EAP-TLS)High
• PostgreSQL: With cert/trust+clientcert auth, a MITM can inject arbitrary SQL at connection setupCVE-2021-23214 · PostgreSQLHigh