@alauda/dp-dynamic-plugin-backend-core (>=0.1.11, <=0.1.12), @alithya-oss/backstage-plugin-aws-apps-backend (>=0.4.5, <=0.4.7) +248 more potentially affected by CVE-2026-24048 via @backstage/backend-defaults (>=0.0.0-nightly-20240929023448, <=0.12.1-next.1)

@backstage/backend-defaults NPM version =0.0.0-nightly-20240929023448, =0.1.11, =0.4.5, =1.0.0, =2.0.6, =0.3.10, =3.0.5, =0.4.1, =2.0.3, =0.3.6, =2.5.0, =0.1.0, =0.0.1, =0.1.0, =0.1.0, =1.0.0 - @aws/amazon-ecr-plugin-for-backstage 0.1.2 and more Source cves: CVE-2026-24048 Source advisory:...

GHSA-Q2X5-4XJX-C6P9 Backstage has a Possible SSRF when reading from allowed URL's in `backend.reading.allow`

Impact The FetchUrlReader component, used by the catalog and other plugins to fetch content from URLs, followed HTTP redirects automatically. This allowed an attacker who controls a host listed in backend.reading.allow to redirect requests to internal or sensitive URLs that are not on the...

Symlink Attack

Overview @backstage/backend-defaults is a Backend defaults used by Backstage backend apps Affected versions of this package are vulnerable to Symlink Attack via multiple actions, including debug:log, fs:delete, and archive extraction. A user who create and execute Scaffolder templates can read,...

@alauda/dp-dynamic-plugin-backend-core (>=0.1.11, <=0.1.12), @alithya-oss/backstage-plugin-aws-apps-backend (>=0.4.5, <=0.4.7) +248 more potentially affected by CVE-2026-24046 via @backstage/backend-defaults (>=0.0.0-nightly-20240929023448, <=0.12.1-next.1)

@backstage/backend-defaults NPM version =0.0.0-nightly-20240929023448, =0.1.11, =0.4.5, =1.0.0, =2.0.6, =0.3.10, =3.0.5, =0.4.1, =2.0.3, =0.3.6, =2.5.0, =0.1.0, =0.0.1, =0.1.0, =0.1.0, =1.0.0 - @aws/amazon-ecr-plugin-for-backstage 0.1.2 and more Source cves: CVE-2026-24046 Source advisory:...

@alauda/dp-dynamic-plugin-backend-core (>=0.1.11, <=0.1.12), @alithya-oss/backstage-plugin-aws-apps-backend (>=0.4.5, <=0.4.7) +248 more potentially affected by CVE-2026-24046 via @backstage/backend-defaults (>=0.0.0-nightly-20240929023448, <=0.12.1-next.1)

@backstage/backend-defaults NPM version =0.0.0-nightly-20240929023448, =0.1.11, =0.4.5, =1.0.0, =2.0.6, =0.3.10, =3.0.5, =0.4.1, =2.0.3, =0.3.6, =2.5.0, =0.1.0, =0.0.1, =0.1.0, =0.1.0, =1.0.0 - @aws/amazon-ecr-plugin-for-backstage 0.1.2 and more Source cves: CVE-2026-24046 Source advisory:...

@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20251218024537, <=0.7.8-next.1), @backstage/plugin-catalog-backend-module-aws (>=0.4.19-next.0, <=0.4.19-next.1) +10 more potentially affected by CVE-2026-24046 via @backstage/backend-defaults (>=0.14.0, <=0.14.1-next.1)

@backstage/backend-defaults NPM version =0.14.0, =0.0.0-nightly-20251218024537, =0.4.19-next.0, =0.7.7-next.0, =0.0.0-nightly-20251218024537, =0.3.19-next.0, =2.1.4-next.0, =1.10.4-next.0, =1.10.4-next.1 Source cves: CVE-2026-24046 Source advisory: OSV:GHSA-RQ6Q-WR2Q-7PGP...

@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20251218024537, <=0.7.8-next.1), @backstage/plugin-catalog-backend-module-aws (>=0.4.19-next.0, <=0.4.19-next.1) +10 more potentially affected by CVE-2026-24046 via @backstage/backend-defaults (>=0.14.0, <=0.14.1-next.1)

@backstage/backend-defaults NPM version =0.14.0, =0.0.0-nightly-20251218024537, =0.4.19-next.0, =0.7.7-next.0, =0.0.0-nightly-20251218024537, =0.3.19-next.0, =2.1.4-next.0, =1.10.4-next.0, =1.10.4-next.1 Source cves: CVE-2026-24046 Source advisory: GHSA-RQ6Q-WR2Q-7PGP...

@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20251218024537, <=0.7.8-next.1), @backstage/backend-test-utils (>=1.10.1-next.0, <=1.10.2-next.1) +14 more potentially affected by CVE-2026-24046 via @backstage/backend-defaults (>=0.14.0-next.0, <=0.14.1-next.1)

@backstage/backend-defaults NPM version =0.14.0-next.0, =0.0.0-nightly-20251218024537, =1.10.1-next.0, =0.4.18-next.0, =0.7.6-next.0, =0.2.16-next.0, =0.7.7-next.0, =0.5.12-next.0, =0.1.6-next.0, =0.0.0-nightly-20251218024537, =0.3.18-next.0, =0.4.17-next.0, =0.3.6-next.0, =2.0.9-next.0,...

@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20251122024148, <=0.7.6-next.1), @backstage/backend-test-utils (>=1.10.0-next.0, <=1.10.0-next.2) +14 more potentially affected by CVE-2026-24046 via @backstage/backend-defaults (>=0.13.1-next.0, <=0.13.1)

@backstage/backend-defaults NPM version =0.13.1-next.0, =0.0.0-nightly-20251122024148, =1.10.0-next.0, =0.4.17-next.0, =0.7.5-next.0, =0.2.15-next.0, =0.7.6-next.0, =0.5.11-next.0, =0.1.5-next.0, =3.0.1-next.0, =0.3.17-next.0, =0.4.16-next.0, =0.3.5-next.0, =2.0.8-next.0, =2.1.2-next.0,...

@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20251122024148, <=0.7.6-next.1), @backstage/backend-test-utils (>=1.10.0-next.0, <=1.10.0-next.2) +14 more potentially affected by CVE-2026-24046 via @backstage/backend-defaults (>=0.13.1-next.0, <=0.13.1)

@backstage/backend-defaults NPM version =0.13.1-next.0, =0.0.0-nightly-20251122024148, =1.10.0-next.0, =0.4.17-next.0, =0.7.5-next.0, =0.2.15-next.0, =0.7.6-next.0, =0.5.11-next.0, =0.1.5-next.0, =3.0.1-next.0, =0.3.17-next.0, =0.4.16-next.0, =0.3.5-next.0, =2.0.8-next.0, =2.1.2-next.0,...

@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20251122024148, <=0.7.6-next.1), @backstage/backend-test-utils (>=1.9.1-next.1, <=1.10.0-next.2) +14 more potentially affected by CVE-2026-24046 via @backstage/backend-defaults (>=0.13.0-next.0, <=0.13.1)

@backstage/backend-defaults NPM version =0.13.0-next.0, =0.0.0-nightly-20251122024148, =1.9.1-next.1, =0.4.16-next.0, =0.7.4-next.0, =0.2.14-next.1, =0.7.5-next.0, =0.5.10-next.0, =0.1.4-next.0, =3.0.0-next.0, =0.3.16-next.0, =0.4.15-next.1, =0.3.4-next.1, =2.0.7-next.0, =2.1.1-next.0,...

@alauda/dp-dynamic-plugin-backend-core (>=0.1.11, <=0.1.12), @alithya-oss/backstage-plugin-aws-apps-backend (>=0.4.5, <=0.4.7) +248 more potentially affected by CVE-2026-24046 via @backstage/backend-defaults (>=0.0.0-nightly-20240929023448, <=0.12.1-next.1)

@backstage/backend-defaults NPM version =0.0.0-nightly-20240929023448, =0.1.11, =0.4.5, =1.0.0, =2.0.6, =0.3.10, =3.0.5, =0.4.1, =2.0.3, =0.3.6, =2.5.0, =0.1.0, =0.0.1, =0.1.0, =0.1.0, =1.0.0 - @aws/amazon-ecr-plugin-for-backstage 0.1.2 and more Source cves: CVE-2026-24046 Source advisory:...

@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20251218024537, <=0.7.8-next.1), @backstage/plugin-catalog-backend-module-aws (>=0.4.19-next.0, <=0.4.19-next.1) +10 more potentially affected by CVE-2026-24046 via @backstage/backend-defaults (>=0.14.0, <=0.14.1-next.1)

@backstage/backend-defaults NPM version =0.14.0, =0.0.0-nightly-20251218024537, =0.4.19-next.0, =0.7.7-next.0, =0.0.0-nightly-20251218024537, =0.3.19-next.0, =2.1.4-next.0, =1.10.4-next.0, =1.10.4-next.1 Source cves: CVE-2026-24046 Source advisory: MEND:CVE-2026-24046...

@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20251122024148, <=0.7.6-next.1), @backstage/backend-test-utils (>=1.10.0-next.0, <=1.10.0-next.2) +14 more potentially affected by CVE-2026-24046 via @backstage/backend-defaults (>=0.13.1-next.0, <=0.13.1)

@backstage/backend-defaults NPM version =0.13.1-next.0, =0.0.0-nightly-20251122024148, =1.10.0-next.0, =0.4.17-next.0, =0.7.5-next.0, =0.2.15-next.0, =0.7.6-next.0, =0.5.11-next.0, =0.1.5-next.0, =3.0.1-next.0, =0.3.17-next.0, =0.4.16-next.0, =0.3.5-next.0, =2.0.8-next.0, =2.1.2-next.0,...

@alauda/dp-dynamic-plugin-backend-core (>=0.1.11, <=0.1.12), @alithya-oss/backstage-plugin-aws-apps-backend (>=0.4.5, <=0.4.7) +248 more potentially affected by CVE-2026-24046 via @backstage/backend-defaults (>=0.0.0-nightly-20240929023448, <=0.12.1-next.1)

@backstage/backend-defaults NPM version =0.0.0-nightly-20240929023448, =0.1.11, =0.4.5, =1.0.0, =2.0.6, =0.3.10, =3.0.5, =0.4.1, =2.0.3, =0.3.6, =2.5.0, =0.1.0, =0.0.1, =0.1.0, =0.1.0, =1.0.0 - @aws/amazon-ecr-plugin-for-backstage 0.1.2 and more Source cves: CVE-2026-24046 Source advisory:...

CVE-2026-24048: Server-Side Request Forgery (SSRF)

Backstage is an open framework for building developer portals, and @backstage/backend-defaults provides the default implementations and setup for a standard Backstage backend app. Prior to versions 0.12.2, 0.13.2, 0.14.1, and 0.15.0, the FetchUrlReader component, used by the catalog and other...

CVE-2026-24046: Improper Limitation of a Pathname to a Restricted Directory

Backstage is an open framework for building developer portals. Multiple Scaffolder actions and archive extraction utilities were vulnerable to symlink-based path traversal attacks. An attacker with access to create and execute Scaffolder templates could exploit symlinks to read arbitrary files vi...

PT-2026-3880

Backstage is an open framework for building developer portals, and @backstage/backend-defaults provides the default implementations and setup for a standard Backstage backend app. Prior to versions 0.12.2, 0.13.2, 0.14.1, and 0.15.0, the FetchUrlReader component, used by the catalog and other...