CVE-2026-115923

A flaw was found in the Backstage plugin-catalog-backend component. This vulnerability allows an authenticated remote attacker with catalog location creation permissions to bypass catalog location rules and import untrusted content. By supplying URLs containing percent-encoded path segments, the...

CVE-2026-106557

A flaw was found in @backstage/plugin-techdocs-node. Improper validation of TechDocs Markdown extension configurations allows an authenticated user who can register or modify documentation sources to access resources outside the intended documentation boundary during build operations. This issue...

CVE-2026-106563

A flaw was found in the Backstage Kubernetes backend plugin @backstage/plugin-kubernetes-backend. Due to improper entity validation in a deprecated services endpoint, an authenticated user with read permissions can submit crafted entity data. This issue allows unauthorized information disclosure,...

GHSA-W658-MH9P-WW8F Backstage catalog rules can be bypassed for URL locations using encoded path segments

Summary @backstage/plugin-catalog-backend matches URL-type locations against catalog.rules location patterns using the raw URL string submitted by the user, while URL readers resolve that same string in canonical form when fetching the location's content. A URL can therefore be crafted so that it...

@backstage/backend-dynamic-feature-service (>=0.8.8-next.0, <=0.8.8-next.1), @backstage/plugin-catalog-backend-module-incremental-ingestion (>=0.9.0-next.0, <=0.9.0-next.1) +2 more potentially affected by CVE-2026-115923 via @backstage/plugin-catalog-backend (>=4.0.1-next.0, <=4.0.1-next.1)

@backstage/plugin-catalog-backend NPM version =4.0.1-next.0, =0.8.8-next.0, =0.9.0-next.0, =0.1.27-next.0, =0.1.5-next.0, =0.1.5-next.1 Source cves: CVE-2026-115923 Source advisory: OSV:GHSA-W658-MH9P-WW8F...

Backstage catalog rules can be bypassed for URL locations using encoded path segments

Summary @backstage/plugin-catalog-backend matches URL-type locations against catalog.rules location patterns using the raw URL string submitted by the user, while URL readers resolve that same string in canonical form when fetching the location's content. A URL can therefore be crafted so that it...

EUVD-2026-110054

Backstage catalog rules can be bypassed for URL locations using encoded path segments...

@backstage/backend-dynamic-feature-service (>=0.8.8-next.0, <=0.8.8-next.1), @backstage/plugin-catalog-backend-module-incremental-ingestion (>=0.9.0-next.0, <=0.9.0-next.1) +2 more potentially affected by CVE-2026-115923 via @backstage/plugin-catalog-backend (>=4.0.1-next.0, <=4.0.1-next.1)

@backstage/plugin-catalog-backend NPM version =4.0.1-next.0, =0.8.8-next.0, =0.9.0-next.0, =0.1.27-next.0, =0.1.5-next.0, =0.1.5-next.1 Source cves: CVE-2026-115923 Source advisory: GHSA-W658-MH9P-WW8F...

CVE-2026-115923

Backstage is an open framework for building developer portals. Prior to 3.9.2 and from 4.0.0 until 4.0.2, DefaultCatalogRulesEnforcer in @backstage/plugin-catalog-backend compares the raw location.target URL against catalog.rules, while URL readers canonicalize the same URL before fetching it. An...

CVE-2026-115923

The Backstage framework (an open framework for building developer portals) is affected by a vulnerability in the @backstage/plugin-catalog-backend component. Specifically, the DefaultCatalogRulesEnforcer compares the raw location.target URL against catalog.rules, but URL readers canonicalize the ...

@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20251122024148, <=0.8.7-next.1), @backstage/plugin-catalog-backend-module-github (>=0.10.1-next.1, <=0.11.1-next.1) +4 more potentially affected by CVE-2026-115923 via @backstage/plugin-catalog-backend (>=3.0.0-next.0, <=3.9.2-next.0)

@backstage/plugin-catalog-backend NPM version =3.0.0-next.0, =0.0.0-nightly-20251122024148, =0.10.1-next.1, =0.3.12-next.1, =0.0.0-nightly-20251123025211, =0.1.12-next.1, =0.1.0-next.0, =0.1.4-next.0 Source cves: CVE-2026-115923 Source advisory: MEND:CVE-2026-115923...

CVE-2026-115923 Backstage catalog rules can be bypassed for URL locations using encoded path segments

Backstage is an open framework for building developer portals. Prior to 3.9.2 and from 4.0.0 until 4.0.2, DefaultCatalogRulesEnforcer in @backstage/plugin-catalog-backend compares the raw location.target URL against catalog.rules, while URL readers canonicalize the same URL before fetching it. An...

CVE-2026-115923

Backstage is an open framework for building developer portals. Prior to 3.9.2 and from 4.0.0 until 4.0.2, DefaultCatalogRulesEnforcer in @backstage/plugin-catalog-backend compares the raw location.target URL against catalog.rules, while URL readers canonicalize the same URL before fetching it. An...

CVE-2026-115923 Backstage catalog rules can be bypassed for URL locations using encoded path segments

Backstage is an open framework for building developer portals. Prior to 3.9.2 and from 4.0.0 until 4.0.2, DefaultCatalogRulesEnforcer in @backstage/plugin-catalog-backend compares the raw location.target URL against catalog.rules, while URL readers canonicalize the same URL before fetching it. An...

CVE-2026-115923 Backstage catalog rules can be bypassed for URL locations using encoded path segments

Backstage is an open framework for building developer portals. Prior to 3.9.2 and from 4.0.0 until 4.0.2, DefaultCatalogRulesEnforcer in @backstage/plugin-catalog-backend compares the raw location.target URL against catalog.rules, while URL readers canonicalize the same URL before fetching it. An...

@backstage/backend-dynamic-feature-service (>=0.8.7-next.2, <=0.8.8-next.1), @backstage/plugin-catalog-backend-module-incremental-ingestion (>=0.8.0-next.1, <=0.9.0-next.1) +2 more potentially affected by CVE-2026-115923 via @backstage/plugin-catalog-backend (>=4.0.0-next.1, <=4.0.1-next.1)

@backstage/plugin-catalog-backend NPM version =4.0.0-next.1, =0.8.7-next.2, =0.8.0-next.1, =0.1.26-next.1, =0.1.4-next.1, =0.1.5-next.1 Source cves: CVE-2026-115923 Source advisory: MEND:CVE-2026-115923...

PT-2026-125033

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 3.9.2 Backstage versions 4.0.0 through 4.0.1 Description In the @backstage/plugin-catalog-backend component, the DefaultCatalogRulesEnforcer compares the raw location.target URL against catalog.rules, whereas URL...

Backstage path traversal vulnerability

Versions prior to Backstage 3.9.2 and versions 4.0.0 through 4.0.2 contain a path traversal vulnerability. This vulnerability arises because DefaultCatalogRulesEnforcer compares the original location.target URL with catalog.rules within @backstage/plugin-catalog-backend; the URL reader then...

CVE-2026-106558

A flaw was found in @backstage/plugin-techdocs-node. An authenticated attacker with permissions to register or modify documentation in a source code management SCM repository can bypass configuration sanitization checks. By providing a crafted markdown extension configuration, the attacker can...

@alauda/dp-dynamic-plugin-backend-core (>=0.1.11, <=0.1.12), @alithya-oss/backstage-plugin-aws-apps-backend (>=0.4.5, <=0.4.7) +307 more potentially affected by CVE-2026-106495 via @backstage/backend-defaults (>=0.0.0-nightly-20240929023448, <=0.17.7)

@backstage/backend-defaults NPM version =0.0.0-nightly-20240929023448, =0.1.11, =0.4.5, =1.0.0, =2.0.6, =1.0.7, =0.1.8, =0.3.10, =3.0.5, =0.4.1, =2.0.3, =1.0.4, =0.1.5, =0.3.6, =2.5.0, =0.1.0, =0.1.1 and more Source cves: CVE-2026-106495 Source advisory: GHSA-3XR5-8W6C-P5GW...