@backstage/plugin-kubernetes (>=0.0.0-nightly-202010102951, <=0.4.2), @devangelista/backstage-scaffolder-kubernetes (>=0.4.0, <=0.5.0) +3 more potentially affected by CVE-2026-106487 via @backstage/plugin-kubernetes-backend (>=0.0.0-nightly-20260928023907, <=0.20.4)

@backstage/plugin-kubernetes-backend NPM version =0.0.0-nightly-20260928023907, =0.0.0-nightly-202010102951, =0.4.0, =1.0.0, =1.1.0, =1.15.1, =2.9.1 Source cves: CVE-2026-106487 Source advisory: OSV:GHSA-H53X-HJX6-25GR...

Backstage: Unsupported catalog cluster authentication mode in kubernetes backend

Impact Deployments using catalog cluster discovery may be affected when catalog contributors can create or modify kubernetes-cluster Resource entities. With the required endpoint permissions and pod RBAC, the backend can use its local in-cluster identity, potentially exposing Kubernetes resources...

@backstage/plugin-auth-backend (>=0.0.0-nightly-20240122021809, <=0.24.4-next.2), @backstage/plugin-auth-backend-module-aws-alb-provider (>=0.0.0-nightly-20240929023448, <=0.4.1-next.2) +1 more potentially affected by CVE-2026-106488 via @backstage/plugin-auth-backend-module-oidc-provider (>=0.0.0-nightly-20240929023448, <=0.4.1-next.2)

@backstage/plugin-auth-backend-module-oidc-provider NPM version =0.0.0-nightly-20240929023448, =0.0.0-nightly-20240122021809, =0.0.0-nightly-20240929023448, =0.2.4-next.2, =0.2.5 Source cves: CVE-2026-106488 Source advisory: OSV:GHSA-826H-28H9-65HG...

EUVD-2026-94007

Backstage: Improper authentication in the OIDC provider...

Backstage: Improper authentication in the OIDC provider

Impact Deployments using OIDC email-based identity resolution with a provider that permits unverified email addresses may allow an authenticated provider user to assume another catalog identity. This may grant access and permissions associated with that user. No direct availability impact is...

@backstage/plugin-auth-backend (>=0.0.0-nightly-20240122021809, <=0.24.4-next.2), @backstage/plugin-auth-backend-module-aws-alb-provider (>=0.0.0-nightly-20240929023448, <=0.4.1-next.2) +1 more potentially affected by CVE-2026-106488 via @backstage/plugin-auth-backend-module-oidc-provider (>=0.0.0-nightly-20240929023448, <=0.4.1-next.2)

@backstage/plugin-auth-backend-module-oidc-provider NPM version =0.0.0-nightly-20240929023448, =0.0.0-nightly-20240122021809, =0.0.0-nightly-20240929023448, =0.2.4-next.2, =0.2.5 Source cves: CVE-2026-106488 Source advisory: GHSA-826H-28H9-65HG...

GHSA-826H-28H9-65HG Backstage: Improper authentication in the OIDC provider

Impact Deployments using OIDC email-based identity resolution with a provider that permits unverified email addresses may allow an authenticated provider user to assume another catalog identity. This may grant access and permissions associated with that user. No direct availability impact is...

Backstage: Improper authorization enforcement for TechDocs static content

Impact An authenticated user with access to one TechDocs documentation site could craft a URL able to read documentation belonging to a different entity. This only affects deployments using the external TechDocs builder with an external storage provider S3, GCS, etc. and the permission framework...

EUVD-2026-94008

Backstage: Improper authorization enforcement for TechDocs static content...

GHSA-RG9R-HR7G-5GC2 Backstage: Improper authorization enforcement for TechDocs static content

Impact An authenticated user with access to one TechDocs documentation site could craft a URL able to read documentation belonging to a different entity. This only affects deployments using the external TechDocs builder with an external storage provider S3, GCS, etc. and the permission framework...

EUVD-2026-94009

Backstage: Improper input validation in TechDocs static content requests...

Backstage: Improper input validation in TechDocs static content requests

Impact When using the Azure Blob Storage provider, an authenticated Backstage user may be able to read restricted TechDocs content when entity-level permissions are enabled. Deployments that intentionally disable the default backend authentication policy may have broader exposure. Patches Patched...

GHSA-7MFX-XG57-53C9 Backstage: Improper input validation in TechDocs static content requests

Impact When using the Azure Blob Storage provider, an authenticated Backstage user may be able to read restricted TechDocs content when entity-level permissions are enabled. Deployments that intentionally disable the default backend authentication policy may have broader exposure. Patches Patched...

@alauda/dp-dynamic-plugin-backend-core (>=0.1.11, <=0.1.12), @alithya-oss/backstage-plugin-aws-apps-backend (>=0.4.5, <=0.4.7) +303 more potentially affected by CVE-2026-106493 via @backstage/backend-defaults (>=0.0.0-nightly-20240929023448, <=0.17.7)

@backstage/backend-defaults NPM version =0.0.0-nightly-20240929023448, =0.1.11, =0.4.5, =1.0.0, =2.0.6, =0.3.10, =3.0.5, =0.4.1, =2.0.3, =0.3.6, =2.5.0, =0.1.0, =0.0.1, =0.1.0, =0.1.0, =0.1.2, =0.2.2 and more Source cves: CVE-2026-106493 Source advisory: GHSA-XVH9-35W9-42M4...

Directory Traversal

Overview @backstage/plugin-catalog-backend-module-aws is an A Backstage catalog backend module that helps integrate towards AWS Affected versions of this package are vulnerable to Directory Traversal via the parseUrl functions in AwsS3UrlReader.ts and AzureBlobStorageUrlReader.ts, where URL path...

Directory Traversal

Overview @backstage/plugin-catalog-backend-module-azure is an A Backstage catalog backend module that helps integrate towards Azure Affected versions of this package are vulnerable to Directory Traversal via the parseUrl functions in AwsS3UrlReader.ts and AzureBlobStorageUrlReader.ts, where URL...

Directory Traversal

Overview @backstage/backend-defaults is a Backend defaults used by Backstage backend apps Affected versions of this package are vulnerable to Directory Traversal via the parseUrl functions in AwsS3UrlReader.ts and AzureBlobStorageUrlReader.ts, where URL path segments are not validated for...

@alauda/dp-dynamic-plugin-backend-core (>=0.1.11, <=0.1.12), @alithya-oss/backstage-plugin-aws-apps-backend (>=0.4.5, <=0.4.7) +303 more potentially affected by CVE-2026-106493 via @backstage/backend-defaults (>=0.0.0-nightly-20240929023448, <=0.17.7)

@backstage/backend-defaults NPM version =0.0.0-nightly-20240929023448, =0.1.11, =0.4.5, =1.0.0, =2.0.6, =0.3.10, =3.0.5, =0.4.1, =2.0.3, =0.3.6, =2.5.0, =0.1.0, =0.0.1, =0.1.0, =0.1.0, =0.1.2, =0.2.2 and more Source cves: CVE-2026-106493 Source advisory: OSV:GHSA-XVH9-35W9-42M4...

EUVD-2026-94013

Backstage: Cloud storage catalog locations may cross configured storage boundaries...

Backstage: Cloud storage catalog locations may cross configured storage boundaries

Impact Catalog entity providers for Azure Blob Storage and AWS S3 did not sufficiently validate storage object paths, which could allow catalog descriptors to be read from outside the intended storage boundary. Access is limited to locations reachable by the backend's configured credentials...