@backstage/plugin-catalog-backend-module-gitlab-org (>=0.0.0-nightly-20240423021331, <=0.2.25-next.0) potentially affected by CVE-2026-106463 via @backstage/plugin-catalog-backend-module-gitlab (>=0.0.0-nightly-20241224023253, <=0.8.7-next.0)

@backstage/plugin-catalog-backend-module-gitlab NPM version =0.0.0-nightly-20241224023253, =0.0.0-nightly-20240423021331, =0.2.25-next.0 Source cves: CVE-2026-106463 Source advisory: GHSA-GP6M-X9VW-5C5X...

GHSA-GP6M-X9VW-5C5X Backstage has improper authorization in GitLab organizational user ingestion

Impact Deployments that enable GitLab organization event ingestion and rely on scoped catalog users as an access boundary may admit an unintended catalog identity. Depending on sign-in and permission configuration, this may allow unauthorized access with the permissions of a standard authenticate...

EUVD-2026-94000

Backstage has improper authorization in GitLab organizational user ingestion...

EUVD-2026-94003

Backstage has iImproper filesystem validation in Bitbucket pull-request scaffolder actions...

EUVD-2026-94005

Backstage: Unsupported catalog cluster authentication mode in kubernetes backend...

GHSA-H53X-HJX6-25GR Backstage: Unsupported catalog cluster authentication mode in kubernetes backend

Impact Deployments using catalog cluster discovery may be affected when catalog contributors can create or modify kubernetes-cluster Resource entities. With the required endpoint permissions and pod RBAC, the backend can use its local in-cluster identity, potentially exposing Kubernetes resources...

Backstage: Unsupported catalog cluster authentication mode in kubernetes backend

Impact Deployments using catalog cluster discovery may be affected when catalog contributors can create or modify kubernetes-cluster Resource entities. With the required endpoint permissions and pod RBAC, the backend can use its local in-cluster identity, potentially exposing Kubernetes resources...

EUVD-2026-94007

Backstage: Improper authentication in the OIDC provider...

GHSA-826H-28H9-65HG Backstage: Improper authentication in the OIDC provider

Impact Deployments using OIDC email-based identity resolution with a provider that permits unverified email addresses may allow an authenticated provider user to assume another catalog identity. This may grant access and permissions associated with that user. No direct availability impact is...

EUVD-2026-94008

Backstage: Improper authorization enforcement for TechDocs static content...

GHSA-RG9R-HR7G-5GC2 Backstage: Improper authorization enforcement for TechDocs static content

Impact An authenticated user with access to one TechDocs documentation site could craft a URL able to read documentation belonging to a different entity. This only affects deployments using the external TechDocs builder with an external storage provider S3, GCS, etc. and the permission framework...

EUVD-2026-94009

Backstage: Improper input validation in TechDocs static content requests...

GHSA-7MFX-XG57-53C9 Backstage: Improper input validation in TechDocs static content requests

Impact When using the Azure Blob Storage provider, an authenticated Backstage user may be able to read restricted TechDocs content when entity-level permissions are enabled. Deployments that intentionally disable the default backend authentication policy may have broader exposure. Patches Patched...

EUVD-2026-94010

Backstage: Improper input validation in proxy-backend...

EUVD-2026-94052

Backstage: Inconsistent enforcement of allowed location types during catalog processing...

GHSA-PCMQ-25R3-5W9V Backstage: Inconsistent enforcement of allowed location types during catalog processing

Impact Under certain configurations, the catalog backend could process location types that were not intended to be allowed, potentially leading to unintended file access on the backend host. Patches Patched in @backstage/plugin-catalog-backend version 3.9.1 Workarounds No practical workarounds ar...

Incorrect Authorization

Overview @backstage/plugin-catalog-backend is a The Backstage backend plugin that provides the Backstage catalog Affected versions of this package are vulnerable to Incorrect Authorization in DefaultCatalogProcessingOrchestrator during catalog processing, where the type field of a registered...

Backstage: Inconsistent enforcement of allowed location types during catalog processing

Impact Under certain configurations, the catalog backend could process location types that were not intended to be allowed, potentially leading to unintended file access on the backend host. Patches Patched in @backstage/plugin-catalog-backend version 3.9.1 Workarounds No practical workarounds ar...

EUVD-2026-94056

Backstage: Improper URL validation in catalog entity placeholder resolution...

GHSA-QGVJ-QCF8-XQ73 Backstage: Improper URL validation in catalog entity placeholder resolution

Impact An authenticated Backstage user could craft a catalog entity with placeholder directives that reference resources outside the entity's source repository. Under certain configurations, this could allow access to data not intended to be available to the user. Patches Patched in...