Backstage: Improper entity validation in deprecated Kubernetes services endpoint

Impact An authenticated user with Kubernetes read permissions could access Kubernetes workload data beyond their intended scope by supplying crafted entity data to the deprecated services endpoint. The exposure is limited to read-only access to Kubernetes object metadata across configured cluster...

Backstage has a sensitive information disclosure in Kubernetes resource queries

Impact An authenticated user holding the standard Kubernetes resource read permission could retrieve sensitive values that the Kubernetes plugin is designed to mask, potentially exposing credentials and other confidential material held in the connected clusters. Exposure is limited to resources...

GHSA-P795-MQF2-36MF Backstage has a sensitive information disclosure in Kubernetes resource queries

Impact An authenticated user holding the standard Kubernetes resource read permission could retrieve sensitive values that the Kubernetes plugin is designed to mask, potentially exposing credentials and other confidential material held in the connected clusters. Exposure is limited to resources...

GHSA-H53X-HJX6-25GR Backstage: Unsupported catalog cluster authentication mode in kubernetes backend

Impact Deployments using catalog cluster discovery may be affected when catalog contributors can create or modify kubernetes-cluster Resource entities. With the required endpoint permissions and pod RBAC, the backend can use its local in-cluster identity, potentially exposing Kubernetes resources...

EUVD-2026-94005

Backstage: Unsupported catalog cluster authentication mode in kubernetes backend...

Backstage: Improper authorization enforcement for TechDocs static content

Impact An authenticated user with access to one TechDocs documentation site could craft a URL able to read documentation belonging to a different entity. This only affects deployments using the external TechDocs builder with an external storage provider S3, GCS, etc. and the permission framework...

EUVD-2026-94009

Backstage: Improper input validation in TechDocs static content requests...

Backstage: Improper input validation in TechDocs static content requests

Impact When using the Azure Blob Storage provider, an authenticated Backstage user may be able to read restricted TechDocs content when entity-level permissions are enabled. Deployments that intentionally disable the default backend authentication policy may have broader exposure. Patches Patched...

GHSA-XVH9-35W9-42M4 Backstage: Cloud storage catalog locations may cross configured storage boundaries

Impact Catalog entity providers for Azure Blob Storage and AWS S3 did not sufficiently validate storage object paths, which could allow catalog descriptors to be read from outside the intended storage boundary. Access is limited to locations reachable by the backend's configured credentials...

EUVD-2026-94013

Backstage: Cloud storage catalog locations may cross configured storage boundaries...

Backstage: Cloud storage catalog locations may cross configured storage boundaries

Impact Catalog entity providers for Azure Blob Storage and AWS S3 did not sufficiently validate storage object paths, which could allow catalog descriptors to be read from outside the intended storage boundary. Access is limited to locations reachable by the backend's configured credentials...

Backstage: Improper URL validation in catalog entity placeholder resolution

Impact An authenticated Backstage user could craft a catalog entity with placeholder directives that reference resources outside the entity's source repository. Under certain configurations, this could allow access to data not intended to be available to the user. Patches Patched in...

EUVD-2026-94056

Backstage: Improper URL validation in catalog entity placeholder resolution...

GHSA-G2V8-7JHW-PP8P Backstage: Sensitive information exposure in Scaffolder

Impact An authenticated Backstage user who can read another user's Scaffolder task may receive internal execution data. In deployments where that data contains credentials for an external service, this may permit disclosure and unauthorized changes in that external service. Patches Patched in...

GHSA-MFVQ-X7VR-RGQG Backstage: Secret-derived values may be exposed in scaffolder task logs

Impact Deployments that configure sensitive scaffolder.defaultEnvironment.secrets and allow an attacker to create or modify Scaffolder templates are affected. A template author could cause secret-derived values used during template iteration to be persisted in task logs, exposing those values to...

EUVD-2026-94057

Backstage: Secret-derived values may be exposed in scaffolder task logs...

Backstage: Secret-derived values may be exposed in scaffolder task logs

Impact Deployments that configure sensitive scaffolder.defaultEnvironment.secrets and allow an attacker to create or modify Scaffolder templates are affected. A template author could cause secret-derived values used during template iteration to be persisted in task logs, exposing those values to...

Backstage: Incorrect authorization in scaffolder task listing

Impact An authenticated internal user may be able to view metadata for scaffolder tasks outside the visibility intended by a deployment's permission policy. Stored task secrets are not included in the affected response, and no integrity or availability impact was identified. Patches Patched in...

EUVD-2026-93996

Backstage: Incorrect authorization in scaffolder task listing...

GHSA-7HFW-GRCM-CQM6 Backstage: Incorrect authorization in scaffolder task listing

Impact An authenticated internal user may be able to view metadata for scaffolder tasks outside the visibility intended by a deployment's permission policy. Stored task secrets are not included in the affected response, and no integrity or availability impact was identified. Patches Patched in...