GHSA-RG9R-HR7G-5GC2 Backstage: Improper authorization enforcement for TechDocs static content

Impact An authenticated user with access to one TechDocs documentation site could craft a URL able to read documentation belonging to a different entity. This only affects deployments using the external TechDocs builder with an external storage provider S3, GCS, etc. and the permission framework...

EUVD-2026-94009

Backstage: Improper input validation in TechDocs static content requests...

GHSA-7MFX-XG57-53C9 Backstage: Improper input validation in TechDocs static content requests

Impact When using the Azure Blob Storage provider, an authenticated Backstage user may be able to read restricted TechDocs content when entity-level permissions are enabled. Deployments that intentionally disable the default backend authentication policy may have broader exposure. Patches Patched...

Directory Traversal

Overview @backstage/plugin-catalog-backend-module-aws is an A Backstage catalog backend module that helps integrate towards AWS Affected versions of this package are vulnerable to Directory Traversal via the parseUrl functions in AwsS3UrlReader.ts and AzureBlobStorageUrlReader.ts, where URL path...

Directory Traversal

Overview @backstage/plugin-catalog-backend-module-azure is an A Backstage catalog backend module that helps integrate towards Azure Affected versions of this package are vulnerable to Directory Traversal via the parseUrl functions in AwsS3UrlReader.ts and AzureBlobStorageUrlReader.ts, where URL...

EUVD-2026-94010

Backstage: Improper input validation in proxy-backend...

Backstage: Improper preservation of access restrictions during service credential delegation

Impact An external service credential configured with access restrictions e.g., read-only could bypass those restrictions by routing requests through plugin delegation paths. This could allow a restricted service to perform operations beyond its intended scope, including write operations on plugi...

Backstage: Inconsistent enforcement of allowed location types during catalog processing

Impact Under certain configurations, the catalog backend could process location types that were not intended to be allowed, potentially leading to unintended file access on the backend host. Patches Patched in @backstage/plugin-catalog-backend version 3.9.1 Workarounds No practical workarounds ar...

EUVD-2026-94052

Backstage: Inconsistent enforcement of allowed location types during catalog processing...

GHSA-PCMQ-25R3-5W9V Backstage: Inconsistent enforcement of allowed location types during catalog processing

Impact Under certain configurations, the catalog backend could process location types that were not intended to be allowed, potentially leading to unintended file access on the backend host. Patches Patched in @backstage/plugin-catalog-backend version 3.9.1 Workarounds No practical workarounds ar...

@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20251122024148, <=0.8.7-next.0), @backstage/plugin-catalog-backend-module-github (>=0.10.1-next.1, <=0.11.1-next.1) +4 more potentially affected by CVE-2026-106496 via @backstage/plugin-catalog-backend (>=3.0.0-next.0, <=3.9.0)

@backstage/plugin-catalog-backend NPM version =3.0.0-next.0, =0.0.0-nightly-20251122024148, =0.10.1-next.1, =0.3.12-next.1, =0.0.0-nightly-20251123025211, =0.1.12-next.1, =0.1.0-next.0, =0.1.3-next.0 Source cves: CVE-2026-106496 Source advisory: OSV:GHSA-PCMQ-25R3-5W9V...

@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20251122024148, <=0.8.7-next.0), @backstage/plugin-catalog-backend-module-github (>=0.10.1-next.1, <=0.11.1-next.1) +4 more potentially affected by CVE-2026-106496 via @backstage/plugin-catalog-backend (>=3.0.0-next.0, <=3.9.0)

@backstage/plugin-catalog-backend NPM version =3.0.0-next.0, =0.0.0-nightly-20251122024148, =0.10.1-next.1, =0.3.12-next.1, =0.0.0-nightly-20251123025211, =0.1.12-next.1, =0.1.0-next.0, =0.1.3-next.0 Source cves: CVE-2026-106496 Source advisory: GHSA-PCMQ-25R3-5W9V...

Incorrect Authorization

Overview @backstage/plugin-catalog-backend is a The Backstage backend plugin that provides the Backstage catalog Affected versions of this package are vulnerable to Incorrect Authorization in DefaultCatalogProcessingOrchestrator during catalog processing, where the type field of a registered...

@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20251122024148, <=0.8.7-next.0), @backstage/plugin-catalog-backend-module-github (>=0.10.1-next.1, <=0.11.1-next.1) +4 more potentially affected by CVE-2026-106498 via @backstage/plugin-catalog-backend (>=3.0.0-next.0, <=3.9.0)

@backstage/plugin-catalog-backend NPM version =3.0.0-next.0, =0.0.0-nightly-20251122024148, =0.10.1-next.1, =0.3.12-next.1, =0.0.0-nightly-20251123025211, =0.1.12-next.1, =0.1.0-next.0, =0.1.3-next.0 Source cves: CVE-2026-106498 Source advisory: OSV:GHSA-QGVJ-QCF8-XQ73...

EUVD-2026-94056

Backstage: Improper URL validation in catalog entity placeholder resolution...

@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20251122024148, <=0.8.7-next.0), @backstage/plugin-catalog-backend-module-github (>=0.10.1-next.1, <=0.11.1-next.1) +4 more potentially affected by CVE-2026-106498 via @backstage/plugin-catalog-backend (>=3.0.0-next.0, <=3.9.0)

@backstage/plugin-catalog-backend NPM version =3.0.0-next.0, =0.0.0-nightly-20251122024148, =0.10.1-next.1, =0.3.12-next.1, =0.0.0-nightly-20251123025211, =0.1.12-next.1, =0.1.0-next.0, =0.1.3-next.0 Source cves: CVE-2026-106498 Source advisory: GHSA-QGVJ-QCF8-XQ73...

GHSA-QGVJ-QCF8-XQ73 Backstage: Improper URL validation in catalog entity placeholder resolution

Impact An authenticated Backstage user could craft a catalog entity with placeholder directives that reference resources outside the entity's source repository. Under certain configurations, this could allow access to data not intended to be available to the user. Patches Patched in...

EUVD-2026-94059

Backstage: Sensitive information exposure in Scaffolder...

EUVD-2026-94057

Backstage: Secret-derived values may be exposed in scaffolder task logs...

GHSA-MFVQ-X7VR-RGQG Backstage: Secret-derived values may be exposed in scaffolder task logs

Impact Deployments that configure sensitive scaffolder.defaultEnvironment.secrets and allow an attacker to create or modify Scaffolder templates are affected. A template author could cause secret-derived values used during template iteration to be persisted in task logs, exposing those values to...