1257 matches found
Backstage: Unsupported catalog cluster authentication mode in kubernetes backend
Impact Deployments using catalog cluster discovery may be affected when catalog contributors can create or modify kubernetes-cluster Resource entities. With the required endpoint permissions and pod RBAC, the backend can use its local in-cluster identity, potentially exposing Kubernetes resources...
Unintended Proxy or Intermediary ('Confused Deputy')
Overview @backstage/plugin-kubernetes-backend is an A Backstage backend plugin that integrates towards Kubernetes Affected versions of this package are vulnerable to Unintended Proxy or Intermediary 'Confused Deputy' via CatalogClusterLocator in...
EUVD-2026-94007
Backstage: Improper authentication in the OIDC provider...
@backstage/plugin-auth-backend (>=0.0.0-nightly-20240122021809, <=0.24.4-next.2), @backstage/plugin-auth-backend-module-aws-alb-provider (>=0.0.0-nightly-20240929023448, <=0.4.1-next.2) +1 more potentially affected by CVE-2026-106488 via @backstage/plugin-auth-backend-module-oidc-provider (>=0.0.0-nightly-20240929023448, <=0.4.1-next.2)
@backstage/plugin-auth-backend-module-oidc-provider NPM version =0.0.0-nightly-20240929023448, =0.0.0-nightly-20240122021809, =0.0.0-nightly-20240929023448, =0.2.4-next.2, =0.2.5 Source cves: CVE-2026-106488 Source advisory: OSV:GHSA-826H-28H9-65HG...
Backstage: Improper authentication in the OIDC provider
Impact Deployments using OIDC email-based identity resolution with a provider that permits unverified email addresses may allow an authenticated provider user to assume another catalog identity. This may grant access and permissions associated with that user. No direct availability impact is...
@backstage/plugin-auth-backend (>=0.0.0-nightly-20240122021809, <=0.24.4-next.2), @backstage/plugin-auth-backend-module-aws-alb-provider (>=0.0.0-nightly-20240929023448, <=0.4.1-next.2) +1 more potentially affected by CVE-2026-106488 via @backstage/plugin-auth-backend-module-oidc-provider (>=0.0.0-nightly-20240929023448, <=0.4.1-next.2)
@backstage/plugin-auth-backend-module-oidc-provider NPM version =0.0.0-nightly-20240929023448, =0.0.0-nightly-20240122021809, =0.0.0-nightly-20240929023448, =0.2.4-next.2, =0.2.5 Source cves: CVE-2026-106488 Source advisory: GHSA-826H-28H9-65HG...
GHSA-826H-28H9-65HG Backstage: Improper authentication in the OIDC provider
Impact Deployments using OIDC email-based identity resolution with a provider that permits unverified email addresses may allow an authenticated provider user to assume another catalog identity. This may grant access and permissions associated with that user. No direct availability impact is...
Backstage: Improper authorization enforcement for TechDocs static content
Impact An authenticated user with access to one TechDocs documentation site could craft a URL able to read documentation belonging to a different entity. This only affects deployments using the external TechDocs builder with an external storage provider S3, GCS, etc. and the permission framework...
EUVD-2026-94008
Backstage: Improper authorization enforcement for TechDocs static content...
GHSA-RG9R-HR7G-5GC2 Backstage: Improper authorization enforcement for TechDocs static content
Impact An authenticated user with access to one TechDocs documentation site could craft a URL able to read documentation belonging to a different entity. This only affects deployments using the external TechDocs builder with an external storage provider S3, GCS, etc. and the permission framework...
EUVD-2026-94009
Backstage: Improper input validation in TechDocs static content requests...
Backstage: Improper input validation in TechDocs static content requests
Impact When using the Azure Blob Storage provider, an authenticated Backstage user may be able to read restricted TechDocs content when entity-level permissions are enabled. Deployments that intentionally disable the default backend authentication policy may have broader exposure. Patches Patched...
GHSA-7MFX-XG57-53C9 Backstage: Improper input validation in TechDocs static content requests
Impact When using the Azure Blob Storage provider, an authenticated Backstage user may be able to read restricted TechDocs content when entity-level permissions are enabled. Deployments that intentionally disable the default backend authentication policy may have broader exposure. Patches Patched...
@alauda/dp-dynamic-plugin-backend-core (>=0.1.11, <=0.1.12), @alithya-oss/backstage-plugin-aws-apps-backend (>=0.4.5, <=0.4.7) +303 more potentially affected by CVE-2026-106493 via @backstage/backend-defaults (>=0.0.0-nightly-20240929023448, <=0.17.7)
@backstage/backend-defaults NPM version =0.0.0-nightly-20240929023448, =0.1.11, =0.4.5, =1.0.0, =2.0.6, =0.3.10, =3.0.5, =0.4.1, =2.0.3, =0.3.6, =2.5.0, =0.1.0, =0.0.1, =0.1.0, =0.1.0, =0.1.2, =0.2.2 and more Source cves: CVE-2026-106493 Source advisory: GHSA-XVH9-35W9-42M4...
@alauda/dp-dynamic-plugin-backend-core (>=0.1.11, <=0.1.12), @alithya-oss/backstage-plugin-aws-apps-backend (>=0.4.5, <=0.4.7) +303 more potentially affected by CVE-2026-106493 via @backstage/backend-defaults (>=0.0.0-nightly-20240929023448, <=0.17.7)
@backstage/backend-defaults NPM version =0.0.0-nightly-20240929023448, =0.1.11, =0.4.5, =1.0.0, =2.0.6, =0.3.10, =3.0.5, =0.4.1, =2.0.3, =0.3.6, =2.5.0, =0.1.0, =0.0.1, =0.1.0, =0.1.0, =0.1.2, =0.2.2 and more Source cves: CVE-2026-106493 Source advisory: OSV:GHSA-XVH9-35W9-42M4...
EUVD-2026-94013
Backstage: Cloud storage catalog locations may cross configured storage boundaries...
Backstage: Cloud storage catalog locations may cross configured storage boundaries
Impact Catalog entity providers for Azure Blob Storage and AWS S3 did not sufficiently validate storage object paths, which could allow catalog descriptors to be read from outside the intended storage boundary. Access is limited to locations reachable by the backend's configured credentials...
GHSA-XVH9-35W9-42M4 Backstage: Cloud storage catalog locations may cross configured storage boundaries
Impact Catalog entity providers for Azure Blob Storage and AWS S3 did not sufficiently validate storage object paths, which could allow catalog descriptors to be read from outside the intended storage boundary. Access is limited to locations reachable by the backend's configured credentials...
Directory Traversal
Overview @backstage/plugin-catalog-backend-module-azure is an A Backstage catalog backend module that helps integrate towards Azure Affected versions of this package are vulnerable to Directory Traversal via the parseUrl functions in AwsS3UrlReader.ts and AzureBlobStorageUrlReader.ts, where URL...
Directory Traversal
Overview @backstage/plugin-catalog-backend-module-aws is an A Backstage catalog backend module that helps integrate towards AWS Affected versions of this package are vulnerable to Directory Traversal via the parseUrl functions in AwsS3UrlReader.ts and AzureBlobStorageUrlReader.ts, where URL path...