@backstage/plugin-scaffolder-backend (>=0.0.0-nightly-20240207020916, <=3.1.3-next.2), @backstage/plugin-scaffolder-backend-module-bitbucket (>=0.0.0-nightly-20240207020916, <=0.3.20-next.0) potentially affected by CVE-2026-106486 via @backstage/plugin-scaffolder-backend-module-bitbucket-server (>=0.0.0-nightly-20240929023448, <=0.2.19-next.0)

@backstage/plugin-scaffolder-backend-module-bitbucket-server NPM version =0.0.0-nightly-20240929023448, =0.0.0-nightly-20240207020916, =0.0.0-nightly-20240207020916, =0.3.20-next.0 Source cves: CVE-2026-106486 Source advisory: GHSA-G8RX-F7M5-7794...

Symlink Attack

Overview @backstage/plugin-scaffolder-backend-module-bitbucket-cloud is a The Bitbucket Cloud module for @backstage/plugin-scaffolder-backend Affected versions of this package are vulnerable to Symlink Attack via the pull request workspace copy logic in bitbucketServerPullRequest.ts and the...

Symlink Attack

Overview @backstage/plugin-scaffolder-backend-module-bitbucket-server is a The Bitbucket Server module for @backstage/plugin-scaffolder-backend Affected versions of this package are vulnerable to Symlink Attack via the pull request workspace copy logic in bitbucketServerPullRequest.ts and the...

@alithya-oss/backstage-plugin-scaffolder-backend-module-aws-apps (>=0.3.10, <=0.3.12), @alithya-oss/plugin-scaffolder-backend-module-aws-apps (>=0.3.6, <=0.3.9) +55 more potentially affected by CVE-2026-106486 via @backstage/plugin-scaffolder-backend-module-bitbucket-cloud (>=0.0.0-nightly-20240929023448, <=0.3.4-next.0)

@backstage/plugin-scaffolder-backend-module-bitbucket-cloud NPM version =0.0.0-nightly-20240929023448, =0.3.10, =0.3.6, =0.1.0, =0.4.0, =0.0.0-nightly-20240207020916, =0.0.0-nightly-20240207020916, =0.2.5, =0.3.5, =0.1.0, =0.2.3, =0.4.3, =0.1.10, =0.1.14 -...

@backstage/plugin-scaffolder-backend (>=0.0.0-nightly-20240207020916, <=3.1.3-next.2), @backstage/plugin-scaffolder-backend-module-bitbucket (>=0.0.0-nightly-20240207020916, <=0.3.20-next.0) potentially affected by CVE-2026-106486 via @backstage/plugin-scaffolder-backend-module-bitbucket-server (>=0.0.0-nightly-20240929023448, <=0.2.19-next.0)

@backstage/plugin-scaffolder-backend-module-bitbucket-server NPM version =0.0.0-nightly-20240929023448, =0.0.0-nightly-20240207020916, =0.0.0-nightly-20240207020916, =0.3.20-next.0 Source cves: CVE-2026-106486 Source advisory: OSV:GHSA-G8RX-F7M5-7794...

EUVD-2026-94003

Backstage has iImproper filesystem validation in Bitbucket pull-request scaffolder actions...

EUVD-2026-94005

Backstage: Unsupported catalog cluster authentication mode in kubernetes backend...

@backstage/plugin-kubernetes (>=0.0.0-nightly-202010102951, <=0.4.2), @devangelista/backstage-scaffolder-kubernetes (>=0.4.0, <=0.5.0) +3 more potentially affected by CVE-2026-106487 via @backstage/plugin-kubernetes-backend (>=0.0.0-nightly-20260928023907, <=0.20.4)

@backstage/plugin-kubernetes-backend NPM version =0.0.0-nightly-20260928023907, =0.0.0-nightly-202010102951, =0.4.0, =1.0.0, =1.1.0, =1.15.1, =2.9.1 Source cves: CVE-2026-106487 Source advisory: GHSA-H53X-HJX6-25GR...

GHSA-H53X-HJX6-25GR Backstage: Unsupported catalog cluster authentication mode in kubernetes backend

Impact Deployments using catalog cluster discovery may be affected when catalog contributors can create or modify kubernetes-cluster Resource entities. With the required endpoint permissions and pod RBAC, the backend can use its local in-cluster identity, potentially exposing Kubernetes resources...

Unintended Proxy or Intermediary ('Confused Deputy')

Overview @backstage/plugin-kubernetes-backend is an A Backstage backend plugin that integrates towards Kubernetes Affected versions of this package are vulnerable to Unintended Proxy or Intermediary 'Confused Deputy' via CatalogClusterLocator in...

@backstage/plugin-kubernetes (>=0.0.0-nightly-202010102951, <=0.4.2), @devangelista/backstage-scaffolder-kubernetes (>=0.4.0, <=0.5.0) +3 more potentially affected by CVE-2026-106487 via @backstage/plugin-kubernetes-backend (>=0.0.0-nightly-20260928023907, <=0.20.4)

@backstage/plugin-kubernetes-backend NPM version =0.0.0-nightly-20260928023907, =0.0.0-nightly-202010102951, =0.4.0, =1.0.0, =1.1.0, =1.15.1, =2.9.1 Source cves: CVE-2026-106487 Source advisory: OSV:GHSA-H53X-HJX6-25GR...

Backstage: Unsupported catalog cluster authentication mode in kubernetes backend

Impact Deployments using catalog cluster discovery may be affected when catalog contributors can create or modify kubernetes-cluster Resource entities. With the required endpoint permissions and pod RBAC, the backend can use its local in-cluster identity, potentially exposing Kubernetes resources...

EUVD-2026-94007

Backstage: Improper authentication in the OIDC provider...

GHSA-826H-28H9-65HG Backstage: Improper authentication in the OIDC provider

Impact Deployments using OIDC email-based identity resolution with a provider that permits unverified email addresses may allow an authenticated provider user to assume another catalog identity. This may grant access and permissions associated with that user. No direct availability impact is...

@backstage/plugin-auth-backend (>=0.0.0-nightly-20240122021809, <=0.24.4-next.2), @backstage/plugin-auth-backend-module-aws-alb-provider (>=0.0.0-nightly-20240929023448, <=0.4.1-next.2) +1 more potentially affected by CVE-2026-106488 via @backstage/plugin-auth-backend-module-oidc-provider (>=0.0.0-nightly-20240929023448, <=0.4.1-next.2)

@backstage/plugin-auth-backend-module-oidc-provider NPM version =0.0.0-nightly-20240929023448, =0.0.0-nightly-20240122021809, =0.0.0-nightly-20240929023448, =0.2.4-next.2, =0.2.5 Source cves: CVE-2026-106488 Source advisory: GHSA-826H-28H9-65HG...

@backstage/plugin-auth-backend (>=0.0.0-nightly-20240122021809, <=0.24.4-next.2), @backstage/plugin-auth-backend-module-aws-alb-provider (>=0.0.0-nightly-20240929023448, <=0.4.1-next.2) +1 more potentially affected by CVE-2026-106488 via @backstage/plugin-auth-backend-module-oidc-provider (>=0.0.0-nightly-20240929023448, <=0.4.1-next.2)

@backstage/plugin-auth-backend-module-oidc-provider NPM version =0.0.0-nightly-20240929023448, =0.0.0-nightly-20240122021809, =0.0.0-nightly-20240929023448, =0.2.4-next.2, =0.2.5 Source cves: CVE-2026-106488 Source advisory: OSV:GHSA-826H-28H9-65HG...

GHSA-RG9R-HR7G-5GC2 Backstage: Improper authorization enforcement for TechDocs static content

Impact An authenticated user with access to one TechDocs documentation site could craft a URL able to read documentation belonging to a different entity. This only affects deployments using the external TechDocs builder with an external storage provider S3, GCS, etc. and the permission framework...

EUVD-2026-94008

Backstage: Improper authorization enforcement for TechDocs static content...

EUVD-2026-94009

Backstage: Improper input validation in TechDocs static content requests...

GHSA-7MFX-XG57-53C9 Backstage: Improper input validation in TechDocs static content requests

Impact When using the Azure Blob Storage provider, an authenticated Backstage user may be able to read restricted TechDocs content when entity-level permissions are enabled. Deployments that intentionally disable the default backend authentication policy may have broader exposure. Patches Patched...