CVE-2026-115923

A flaw was found in the Backstage plugin-catalog-backend component. This vulnerability allows an authenticated remote attacker with catalog location creation permissions to bypass catalog location rules and import untrusted content. By supplying URLs containing percent-encoded path segments, the...

CVE-2026-115366

A flaw was found in OpenBao. An improper authorization vulnerability in the plugin catalog interface allows an authenticated user with privileged access in a child namespace to modify system-wide plugin configurations. Because access to these endpoints is not restricted to the root namespace, an...

BIT-OPENBAO-2026-115366 OpenBao 2.3.0 before 2.6.3 Missing Root Namespace Enforcement in Plugin Catalog APIs

OpenBao from 2.3.0 before 2.6.3 contains an improper authorization vulnerability that allows privileged child-namespace tokens to modify plugin registrations because /v1/sys/plugins/catalog/ is not restricted to the root namespace. Attackers can remove existing registrations, create invalid ones,...

GHSA-W658-MH9P-WW8F Backstage catalog rules can be bypassed for URL locations using encoded path segments

Summary @backstage/plugin-catalog-backend matches URL-type locations against catalog.rules location patterns using the raw URL string submitted by the user, while URL readers resolve that same string in canonical form when fetching the location's content. A URL can therefore be crafted so that it...

@backstage/backend-dynamic-feature-service (>=0.8.8-next.0, <=0.8.8-next.1), @backstage/plugin-catalog-backend-module-incremental-ingestion (>=0.9.0-next.0, <=0.9.0-next.1) +2 more potentially affected by CVE-2026-115923 via @backstage/plugin-catalog-backend (>=4.0.1-next.0, <=4.0.1-next.1)

@backstage/plugin-catalog-backend NPM version =4.0.1-next.0, =0.8.8-next.0, =0.9.0-next.0, =0.1.27-next.0, =0.1.5-next.0, =0.1.5-next.1 Source cves: CVE-2026-115923 Source advisory: OSV:GHSA-W658-MH9P-WW8F...

@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20251122024148, <=0.8.7-next.1), @backstage/plugin-catalog-backend-module-github (>=0.10.1-next.1, <=0.11.1-next.1) +4 more potentially affected by CVE-2026-115923 via @backstage/plugin-catalog-backend (>=3.0.0-next.0, <=3.9.2-next.0)

@backstage/plugin-catalog-backend NPM version =3.0.0-next.0, =0.0.0-nightly-20251122024148, =0.10.1-next.1, =0.3.12-next.1, =0.0.0-nightly-20251123025211, =0.1.12-next.1, =0.1.0-next.0, =0.1.4-next.0 Source cves: CVE-2026-115923 Source advisory: GHSA-W658-MH9P-WW8F...

@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20251122024148, <=0.8.7-next.1), @backstage/plugin-catalog-backend-module-github (>=0.10.1-next.1, <=0.11.1-next.1) +4 more potentially affected by CVE-2026-115923 via @backstage/plugin-catalog-backend (>=3.0.0-next.0, <=3.9.2-next.0)

@backstage/plugin-catalog-backend NPM version =3.0.0-next.0, =0.0.0-nightly-20251122024148, =0.10.1-next.1, =0.3.12-next.1, =0.0.0-nightly-20251123025211, =0.1.12-next.1, =0.1.0-next.0, =0.1.4-next.0 Source cves: CVE-2026-115923 Source advisory: OSV:GHSA-W658-MH9P-WW8F...

Backstage catalog rules can be bypassed for URL locations using encoded path segments

Summary @backstage/plugin-catalog-backend matches URL-type locations against catalog.rules location patterns using the raw URL string submitted by the user, while URL readers resolve that same string in canonical form when fetching the location's content. A URL can therefore be crafted so that it...

@backstage/backend-dynamic-feature-service (>=0.8.8-next.0, <=0.8.8-next.1), @backstage/plugin-catalog-backend-module-incremental-ingestion (>=0.9.0-next.0, <=0.9.0-next.1) +2 more potentially affected by CVE-2026-115923 via @backstage/plugin-catalog-backend (>=4.0.1-next.0, <=4.0.1-next.1)

@backstage/plugin-catalog-backend NPM version =4.0.1-next.0, =0.8.8-next.0, =0.9.0-next.0, =0.1.27-next.0, =0.1.5-next.0, =0.1.5-next.1 Source cves: CVE-2026-115923 Source advisory: GHSA-W658-MH9P-WW8F...

CVE-2026-115923

Backstage is an open framework for building developer portals. Prior to 3.9.2 and from 4.0.0 until 4.0.2, DefaultCatalogRulesEnforcer in @backstage/plugin-catalog-backend compares the raw location.target URL against catalog.rules, while URL readers canonicalize the same URL before fetching it. An...

@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20251122024148, <=0.8.7-next.1), @backstage/plugin-catalog-backend-module-github (>=0.10.1-next.1, <=0.11.1-next.1) +4 more potentially affected by CVE-2026-115923 via @backstage/plugin-catalog-backend (>=3.0.0-next.0, <=3.9.2-next.0)

@backstage/plugin-catalog-backend NPM version =3.0.0-next.0, =0.0.0-nightly-20251122024148, =0.10.1-next.1, =0.3.12-next.1, =0.0.0-nightly-20251123025211, =0.1.12-next.1, =0.1.0-next.0, =0.1.4-next.0 Source cves: CVE-2026-115923 Source advisory: MEND:CVE-2026-115923...

CVE-2026-115923

Backstage is an open framework for building developer portals. Prior to 3.9.2 and from 4.0.0 until 4.0.2, DefaultCatalogRulesEnforcer in @backstage/plugin-catalog-backend compares the raw location.target URL against catalog.rules, while URL readers canonicalize the same URL before fetching it. An...

CVE-2026-115923 Backstage catalog rules can be bypassed for URL locations using encoded path segments

Backstage is an open framework for building developer portals. Prior to 3.9.2 and from 4.0.0 until 4.0.2, DefaultCatalogRulesEnforcer in @backstage/plugin-catalog-backend compares the raw location.target URL against catalog.rules, while URL readers canonicalize the same URL before fetching it. An...

@backstage/backend-dynamic-feature-service (>=0.8.7-next.2, <=0.8.8-next.1), @backstage/plugin-catalog-backend-module-incremental-ingestion (>=0.8.0-next.1, <=0.9.0-next.1) +2 more potentially affected by CVE-2026-115923 via @backstage/plugin-catalog-backend (>=4.0.0-next.1, <=4.0.1-next.1)

@backstage/plugin-catalog-backend NPM version =4.0.0-next.1, =0.8.7-next.2, =0.8.0-next.1, =0.1.26-next.1, =0.1.4-next.1, =0.1.5-next.1 Source cves: CVE-2026-115923 Source advisory: MEND:CVE-2026-115923...

Backstage path traversal vulnerability

Versions prior to Backstage 3.9.2 and versions 4.0.0 through 4.0.2 contain a path traversal vulnerability. This vulnerability arises because DefaultCatalogRulesEnforcer compares the original location.target URL with catalog.rules within @backstage/plugin-catalog-backend; the URL reader then...

PT-2026-125033

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 3.9.2 Backstage versions 4.0.0 through 4.0.1 Description In the @backstage/plugin-catalog-backend component, the DefaultCatalogRulesEnforcer compares the raw location.target URL against catalog.rules, whereas URL...

CVE-2026-115366 OpenBao 2.3.0 before 2.6.3 Missing Root Namespace Enforcement in Plugin Catalog APIs

OpenBao from 2.3.0 before 2.6.3 contains an improper authorization vulnerability that allows privileged child-namespace tokens to modify plugin registrations because /v1/sys/plugins/catalog/ is not restricted to the root namespace. Attackers can remove existing registrations, create invalid ones,...

CVE-2026-115366

Versions 2.3.0 through 2.6.3 of OpenBao are vulnerable to an improper authorization flaw. The issue arises because the /v1/sys/plugins/catalog/* API endpoint is not restricted to the root namespace, allowing privileged child-namespace tokens to modify plugin registrations. An attacker can leverag...

CVE-2026-115366 OpenBao 2.3.0 before 2.6.3 Missing Root Namespace Enforcement in Plugin Catalog APIs

OpenBao from 2.3.0 before 2.6.3 contains an improper authorization vulnerability that allows privileged child-namespace tokens to modify plugin registrations because /v1/sys/plugins/catalog/ is not restricted to the root namespace. Attackers can remove existing registrations, create invalid ones,...

CVE-2026-115366 OpenBao 2.3.0 before 2.6.3 Missing Root Namespace Enforcement in Plugin Catalog APIs

OpenBao from 2.3.0 before 2.6.3 contains an improper authorization vulnerability that allows privileged child-namespace tokens to modify plugin registrations because /v1/sys/plugins/catalog/ is not restricted to the root namespace. Attackers can remove existing registrations, create invalid ones,...