CVE-2026-106492

The Backstage framework is vulnerable in the @backstage/backend-defaults package prior to versions 0.16.1 and 0.17.8 . The root cause is the improper preservation of access restrictions during service credential delegation. Specifically, an external service credential with restrictions (such as r...

CVE-2026-106492 Backstage: Improper preservation of access restrictions during service credential delegation

Backstage is an open framework for building developer portals. Prior to 0.16.1 and 0.17.8, the @backstage/backend-defaults package is affected by improper preservation of access restrictions during service credential delegation. An external service credential configured with access restrictions...

CVE-2026-106492 Backstage: Improper preservation of access restrictions during service credential delegation

Backstage is an open framework for building developer portals. Prior to 0.16.1 and 0.17.8, the @backstage/backend-defaults package is affected by improper preservation of access restrictions during service credential delegation. An external service credential configured with access restrictions...

PT-2026-107279

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 0.17.8 Description The @backstage/backend-defaults package contains improper input validation within cloud storage URL readers. An attacker possessing write access to a cloud storage bucket utilized by the framework...

PT-2026-107277

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 0.16.1 Backstage versions prior to 0.17.8 Description The @backstage/backend-defaults package fails to properly preserve access restrictions during service credential delegation. An external service credential...

CVE-2026-106494: Improper Limitation of a Pathname to a Restricted Directory

Backstage is an open framework for building developer portals. Prior to 0.17.8, the @backstage/backend-defaults package is affected by improper input validation in cloud storage url readers. An attacker with write access to a cloud storage bucket used by Backstage could craft object names that...

CVE-2026-106492: Improper Privilege Management

Backstage is an open framework for building developer portals. Prior to 0.16.1 and 0.17.8, the @backstage/backend-defaults package is affected by improper preservation of access restrictions during service credential delegation. An external service credential configured with access restrictions...

CVE-2026-24048

Backstage is an open framework for building developer portals, and @backstage/backend-defaults provides the default implementations and setup for a standard Backstage backend app. Prior to versions 0.12.2, 0.13.2, 0.14.1, and 0.15.0, the "FetchUrlReader" component, used by the catalog and other...

@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20251122024148, <=0.7.6-next.1), @backstage/backend-test-utils (>=1.10.0-next.0, <=1.10.0-next.2) +14 more potentially affected by CVE-2026-24048 via @backstage/backend-defaults (>=0.13.1-next.0, <=0.13.1)

@backstage/backend-defaults NPM version =0.13.1-next.0, =0.0.0-nightly-20251122024148, =1.10.0-next.0, =0.4.17-next.0, =0.7.5-next.0, =0.2.15-next.0, =0.7.6-next.0, =0.5.11-next.0, =0.1.5-next.0, =3.0.1-next.0, =0.3.17-next.0, =0.4.16-next.0, =0.3.5-next.0, =2.0.8-next.0, =2.1.2-next.0,...

@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20251218024537, <=0.7.8-next.1), @backstage/plugin-catalog-backend-module-aws (>=0.4.19-next.0, <=0.4.19-next.1) +10 more potentially affected by CVE-2026-24048 via @backstage/backend-defaults (>=0.14.0, <=0.14.1-next.1)

@backstage/backend-defaults NPM version =0.14.0, =0.0.0-nightly-20251218024537, =0.4.19-next.0, =0.7.7-next.0, =0.0.0-nightly-20251218024537, =0.3.19-next.0, =2.1.4-next.0, =1.10.4-next.0, =1.10.4-next.1 Source cves: CVE-2026-24048 Source advisory: MEND:CVE-2026-24048...

@alauda/dp-dynamic-plugin-backend-core (>=0.1.11, <=0.1.12), @alithya-oss/backstage-plugin-aws-apps-backend (>=0.4.5, <=0.4.7) +248 more potentially affected by CVE-2026-24048 via @backstage/backend-defaults (>=0.0.0-nightly-20240929023448, <=0.12.1-next.1)

@backstage/backend-defaults NPM version =0.0.0-nightly-20240929023448, =0.1.11, =0.4.5, =1.0.0, =2.0.6, =0.3.10, =3.0.5, =0.4.1, =2.0.3, =0.3.6, =2.5.0, =0.1.0, =0.0.1, =0.1.0, =0.1.0, =1.0.0 - @aws/amazon-ecr-plugin-for-backstage 0.1.2 and more Source cves: CVE-2026-24048 Source advisory:...

@alauda/dp-dynamic-plugin-backend-core (>=0.1.11, <=0.1.12), @alithya-oss/backstage-plugin-aws-apps-backend (>=0.4.5, <=0.4.7) +248 more potentially affected by CVE-2026-24048 via @backstage/backend-defaults (>=0.0.0-nightly-20240929023448, <=0.12.1-next.1)

@backstage/backend-defaults NPM version =0.0.0-nightly-20240929023448, =0.1.11, =0.4.5, =1.0.0, =2.0.6, =0.3.10, =3.0.5, =0.4.1, =2.0.3, =0.3.6, =2.5.0, =0.1.0, =0.0.1, =0.1.0, =0.1.0, =1.0.0 - @aws/amazon-ecr-plugin-for-backstage 0.1.2 and more Source cves: CVE-2026-24048 Source advisory:...

@alauda/dp-dynamic-plugin-backend-core (>=0.1.11, <=0.1.12), @alithya-oss/backstage-plugin-aws-apps-backend (>=0.4.5, <=0.4.7) +248 more potentially affected by CVE-2026-24048 via @backstage/backend-defaults (>=0.0.0-nightly-20240929023448, <=0.12.1-next.1)

@backstage/backend-defaults NPM version =0.0.0-nightly-20240929023448, =0.1.11, =0.4.5, =1.0.0, =2.0.6, =0.3.10, =3.0.5, =0.4.1, =2.0.3, =0.3.6, =2.5.0, =0.1.0, =0.0.1, =0.1.0, =0.1.0, =1.0.0 - @aws/amazon-ecr-plugin-for-backstage 0.1.2 and more Source cves: CVE-2026-24048 Source advisory:...

Backstage has a Possible SSRF when reading from allowed URL's in `backend.reading.allow`

Impact The FetchUrlReader component, used by the catalog and other plugins to fetch content from URLs, followed HTTP redirects automatically. This allowed an attacker who controls a host listed in backend.reading.allow to redirect requests to internal or sensitive URLs that are not on the...

@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20251122024148, <=0.7.6-next.1), @backstage/backend-test-utils (>=1.9.1-next.1, <=1.10.0-next.2) +14 more potentially affected by CVE-2026-24048 via @backstage/backend-defaults (>=0.13.0-next.0, <=0.13.1)

@backstage/backend-defaults NPM version =0.13.0-next.0, =0.0.0-nightly-20251122024148, =1.9.1-next.1, =0.4.16-next.0, =0.7.4-next.0, =0.2.14-next.1, =0.7.5-next.0, =0.5.10-next.0, =0.1.4-next.0, =3.0.0-next.0, =0.3.16-next.0, =0.4.15-next.1, =0.3.4-next.1, =2.0.7-next.0, =2.1.1-next.0,...

@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20251122024148, <=0.7.6-next.1), @backstage/backend-test-utils (>=1.10.0-next.0, <=1.10.0-next.2) +14 more potentially affected by CVE-2026-24048 via @backstage/backend-defaults (>=0.13.1-next.0, <=0.13.1)

@backstage/backend-defaults NPM version =0.13.1-next.0, =0.0.0-nightly-20251122024148, =1.10.0-next.0, =0.4.17-next.0, =0.7.5-next.0, =0.2.15-next.0, =0.7.6-next.0, =0.5.11-next.0, =0.1.5-next.0, =3.0.1-next.0, =0.3.17-next.0, =0.4.16-next.0, =0.3.5-next.0, =2.0.8-next.0, =2.1.2-next.0,...

@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20251122024148, <=0.7.6-next.1), @backstage/backend-test-utils (>=1.10.0-next.0, <=1.10.0-next.2) +14 more potentially affected by CVE-2026-24048 via @backstage/backend-defaults (>=0.13.1-next.0, <=0.13.1)

@backstage/backend-defaults NPM version =0.13.1-next.0, =0.0.0-nightly-20251122024148, =1.10.0-next.0, =0.4.17-next.0, =0.7.5-next.0, =0.2.15-next.0, =0.7.6-next.0, =0.5.11-next.0, =0.1.5-next.0, =3.0.1-next.0, =0.3.17-next.0, =0.4.16-next.0, =0.3.5-next.0, =2.0.8-next.0, =2.1.2-next.0,...

@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20251218024537, <=0.7.8-next.1), @backstage/backend-test-utils (>=1.10.1-next.0, <=1.10.2-next.1) +14 more potentially affected by CVE-2026-24048 via @backstage/backend-defaults (>=0.14.0-next.0, <=0.14.1-next.1)

@backstage/backend-defaults NPM version =0.14.0-next.0, =0.0.0-nightly-20251218024537, =1.10.1-next.0, =0.4.18-next.0, =0.7.6-next.0, =0.2.16-next.0, =0.7.7-next.0, =0.5.12-next.0, =0.1.6-next.0, =0.0.0-nightly-20251218024537, =0.3.18-next.0, =0.4.17-next.0, =0.3.6-next.0, =2.0.9-next.0,...

@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20251218024537, <=0.7.8-next.1), @backstage/plugin-catalog-backend-module-aws (>=0.4.19-next.0, <=0.4.19-next.1) +10 more potentially affected by CVE-2026-24048 via @backstage/backend-defaults (>=0.14.0, <=0.14.1-next.1)

@backstage/backend-defaults NPM version =0.14.0, =0.0.0-nightly-20251218024537, =0.4.19-next.0, =0.7.7-next.0, =0.0.0-nightly-20251218024537, =0.3.19-next.0, =2.1.4-next.0, =1.10.4-next.0, =1.10.4-next.1 Source cves: CVE-2026-24048 Source advisory: OSV:GHSA-Q2X5-4XJX-C6P9...

@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20251218024537, <=0.7.8-next.1), @backstage/plugin-catalog-backend-module-aws (>=0.4.19-next.0, <=0.4.19-next.1) +10 more potentially affected by CVE-2026-24048 via @backstage/backend-defaults (>=0.14.0, <=0.14.1-next.1)

@backstage/backend-defaults NPM version =0.14.0, =0.0.0-nightly-20251218024537, =0.4.19-next.0, =0.7.7-next.0, =0.0.0-nightly-20251218024537, =0.3.19-next.0, =2.1.4-next.0, =1.10.4-next.0, =1.10.4-next.1 Source cves: CVE-2026-24048 Source advisory: GHSA-Q2X5-4XJX-C6P9...