GHSA-PCMQ-25R3-5W9V Backstage: Inconsistent enforcement of allowed location types during catalog processing

Impact Under certain configurations, the catalog backend could process location types that were not intended to be allowed, potentially leading to unintended file access on the backend host. Patches Patched in @backstage/plugin-catalog-backend version 3.9.1 Workarounds No practical workarounds ar...

@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20251122024148, <=0.8.7-next.0), @backstage/plugin-catalog-backend-module-github (>=0.10.1-next.1, <=0.11.1-next.1) +4 more potentially affected by CVE-2026-106496 via @backstage/plugin-catalog-backend (>=3.0.0-next.0, <=3.9.0)

@backstage/plugin-catalog-backend NPM version =3.0.0-next.0, =0.0.0-nightly-20251122024148, =0.10.1-next.1, =0.3.12-next.1, =0.0.0-nightly-20251123025211, =0.1.12-next.1, =0.1.0-next.0, =0.1.3-next.0 Source cves: CVE-2026-106496 Source advisory: OSV:GHSA-PCMQ-25R3-5W9V...

@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20251122024148, <=0.8.7-next.0), @backstage/plugin-catalog-backend-module-github (>=0.10.1-next.1, <=0.11.1-next.1) +4 more potentially affected by CVE-2026-106496 via @backstage/plugin-catalog-backend (>=3.0.0-next.0, <=3.9.0)

@backstage/plugin-catalog-backend NPM version =3.0.0-next.0, =0.0.0-nightly-20251122024148, =0.10.1-next.1, =0.3.12-next.1, =0.0.0-nightly-20251123025211, =0.1.12-next.1, =0.1.0-next.0, =0.1.3-next.0 Source cves: CVE-2026-106496 Source advisory: GHSA-PCMQ-25R3-5W9V...

Incorrect Authorization

Overview @backstage/plugin-catalog-backend is a The Backstage backend plugin that provides the Backstage catalog Affected versions of this package are vulnerable to Incorrect Authorization in DefaultCatalogProcessingOrchestrator during catalog processing, where the type field of a registered...

EUVD-2026-94056

Backstage: Improper URL validation in catalog entity placeholder resolution...

@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20251122024148, <=0.8.7-next.0), @backstage/plugin-catalog-backend-module-github (>=0.10.1-next.1, <=0.11.1-next.1) +4 more potentially affected by CVE-2026-106498 via @backstage/plugin-catalog-backend (>=3.0.0-next.0, <=3.9.0)

@backstage/plugin-catalog-backend NPM version =3.0.0-next.0, =0.0.0-nightly-20251122024148, =0.10.1-next.1, =0.3.12-next.1, =0.0.0-nightly-20251123025211, =0.1.12-next.1, =0.1.0-next.0, =0.1.3-next.0 Source cves: CVE-2026-106498 Source advisory: OSV:GHSA-QGVJ-QCF8-XQ73...

@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20251122024148, <=0.8.7-next.0), @backstage/plugin-catalog-backend-module-github (>=0.10.1-next.1, <=0.11.1-next.1) +4 more potentially affected by CVE-2026-106498 via @backstage/plugin-catalog-backend (>=3.0.0-next.0, <=3.9.0)

@backstage/plugin-catalog-backend NPM version =3.0.0-next.0, =0.0.0-nightly-20251122024148, =0.10.1-next.1, =0.3.12-next.1, =0.0.0-nightly-20251123025211, =0.1.12-next.1, =0.1.0-next.0, =0.1.3-next.0 Source cves: CVE-2026-106498 Source advisory: GHSA-QGVJ-QCF8-XQ73...

GHSA-QGVJ-QCF8-XQ73 Backstage: Improper URL validation in catalog entity placeholder resolution

Impact An authenticated Backstage user could craft a catalog entity with placeholder directives that reference resources outside the entity's source repository. Under certain configurations, this could allow access to data not intended to be available to the user. Patches Patched in...

EUVD-2026-94059

Backstage: Sensitive information exposure in Scaffolder...

GHSA-MFVQ-X7VR-RGQG Backstage: Secret-derived values may be exposed in scaffolder task logs

Impact Deployments that configure sensitive scaffolder.defaultEnvironment.secrets and allow an attacker to create or modify Scaffolder templates are affected. A template author could cause secret-derived values used during template iteration to be persisted in task logs, exposing those values to...

EUVD-2026-94057

Backstage: Secret-derived values may be exposed in scaffolder task logs...

EUVD-2026-94068

Backstage: Scaffolder action input authorization bypass...

Backstage: Scaffolder action input authorization bypass

Impact An authenticated user with access to affected Scaffolder templates could bypass configured action restrictions. Depending on integration credentials, this could grant unauthorized access to repositories and related source-control resources. Patches Patched in...

GHSA-HMP2-4M7G-22CV Backstage: Scaffolder action input authorization bypass

Impact An authenticated user with access to affected Scaffolder templates could bypass configured action restrictions. Depending on integration credentials, this could grant unauthorized access to repositories and related source-control resources. Patches Patched in...

EUVD-2026-94058

Backstage: Improper task state validation in Scaffolder backend...

Backstage: Improper task state validation in Scaffolder backend

Impact An authenticated user with permission to create and access Scaffolder tasks may, under specific timing and deployment conditions, affect files accessible to the Backstage backend. If backend application files are writable, the confidentiality, integrity, and availability of the backend may...

EUVD-2026-93996

Backstage: Incorrect authorization in scaffolder task listing...

Backstage: Incorrect authorization in scaffolder task listing

Impact An authenticated internal user may be able to view metadata for scaffolder tasks outside the visibility intended by a deployment's permission policy. Stored task secrets are not included in the affected response, and no integrity or availability impact was identified. Patches Patched in...

CVE-2026-106487

A flaw was found in the plugin-kubernetes-backend component of Backstage. In environments configured for catalog cluster discovery, an authenticated catalog contributor can define an unsupported authentication mode on cluster resource entities. This vulnerability allows the backend to query the...

CVE-2026-106496

A flaw was found in the Backstage plugin-catalog-backend component. Due to inconsistent enforcement of allowed location types during catalog processing, an authenticated remote attacker can submit location targets that should be restricted under specific configurations. This flaw can enable the...