CVE-2026-106558

A flaw was found in @backstage/plugin-techdocs-node. An authenticated attacker with permissions to register or modify documentation in a source code management SCM repository can bypass configuration sanitization checks. By providing a crafted markdown extension configuration, the attacker can...

EUVD-2026-93990

Backstage: Insufficient audience validation in the Cloudflare Access auth provider...

Backstage: Insufficient audience validation in the Cloudflare Access auth provider

Impact The Cloudflare Access auth provider verifies a token's signature and team issuer, but affected versions do not verify that the token was issued for the Backstage application. A user holding a valid token for another Access application in the same Cloudflare Zero Trust team may therefore be...

@backstage/plugin-auth-backend (>=0.0.0-nightly-20250225023230, <=0.24.5), @backstage/plugin-auth-backend-module-aws-alb-provider (>=0.0.0-nightly-20250225023230, <=0.4.2) +2 more potentially affected by CVE-2026-106457 via @backstage/plugin-auth-backend-module-cloudflare-access-provider (>=0.1.6-next.2, <=0.4.18)

@backstage/plugin-auth-backend-module-cloudflare-access-provider NPM version =0.1.6-next.2, =0.0.0-nightly-20250225023230, =0.0.0-nightly-20250225023230, =0.0.0-nightly-20250225023230, =0.4.2 - @jiteshy/backstage-plugin-synergy-backend 1.2.2 Source cves: CVE-2026-106457 Source advisory:...

@backstage/plugin-auth-backend (>=0.0.0-nightly-20250225023230, <=0.24.5), @backstage/plugin-auth-backend-module-aws-alb-provider (>=0.0.0-nightly-20250225023230, <=0.4.2) +2 more potentially affected by CVE-2026-106457 via @backstage/plugin-auth-backend-module-cloudflare-access-provider (>=0.1.6-next.2, <=0.4.18)

@backstage/plugin-auth-backend-module-cloudflare-access-provider NPM version =0.1.6-next.2, =0.0.0-nightly-20250225023230, =0.0.0-nightly-20250225023230, =0.0.0-nightly-20250225023230, =0.4.2 - @jiteshy/backstage-plugin-synergy-backend 1.2.2 Source cves: CVE-2026-106457 Source advisory:...

EUVD-2026-93986

Backstage: Improper validation of MkDocs plugin configuration in TechDocs...

Backstage: Improper validation of MkDocs plugin configuration in TechDocs

Impact An authenticated attacker with control over a TechDocs source repository could cause a documentation build to retrieve and publish data from network locations reachable by the build environment. Exposure depends on deployment topology, build mode, and target endpoint protections. Modern...

GHSA-Q38J-6VCM-2F5M Backstage: Improper validation of MkDocs plugin configuration in TechDocs

Impact An authenticated attacker with control over a TechDocs source repository could cause a documentation build to retrieve and publish data from network locations reachable by the build environment. Exposure depends on deployment topology, build mode, and target endpoint protections. Modern...

@backstage/plugin-search-backend-module-techdocs (>=0.0.0-nightly-20260822023239, <=0.4.18-next.0), @backstage/plugin-techdocs-backend (>=0.0.0-nightly-20260827035829, <=2.2.3-next.1) +1 more potentially affected by CVE-2026-106455 via @backstage/plugin-techdocs-node (>=1.15.1-next.0, <=1.15.3)

@backstage/plugin-techdocs-node NPM version =1.15.1-next.0, =0.0.0-nightly-20260822023239, =0.0.0-nightly-20260827035829, =0.0.0-nightly-20260823023807, =1.11.4-next.0 Source cves: CVE-2026-106455 Source advisory: OSV:GHSA-Q38J-6VCM-2F5M...

@backstage/plugin-search-backend-module-techdocs (>=0.0.0-nightly-20260415031804, <=0.4.14-next.0), @backstage/plugin-techdocs-backend (>=0.0.0-nightly-2021111822616, <=2.1.8-next.0) +2 more potentially affected by CVE-2026-106455 via @backstage/plugin-techdocs-node (>=0.11.12, <=1.14.6-next.0)

@backstage/plugin-techdocs-node NPM version =0.11.12, =0.0.0-nightly-20260415031804, =0.0.0-nightly-2021111822616, =0.11.12-next.0, =0.0.0-nightly-2021111822616, =1.10.8-next.0 Source cves: CVE-2026-106455 Source advisory: GHSA-Q38J-6VCM-2F5M...

@backstage/plugin-search-backend-module-techdocs (>=0.0.0-nightly-20260415031804, <=0.4.14-next.0), @backstage/plugin-techdocs-backend (>=0.0.0-nightly-2021111822616, <=2.1.8-next.0) +2 more potentially affected by CVE-2026-106455 via @backstage/plugin-techdocs-node (>=0.11.12, <=1.14.6-next.0)

@backstage/plugin-techdocs-node NPM version =0.11.12, =0.0.0-nightly-20260415031804, =0.0.0-nightly-2021111822616, =0.11.12-next.0, =0.0.0-nightly-2021111822616, =1.10.8-next.0 Source cves: CVE-2026-106455 Source advisory: OSV:GHSA-Q38J-6VCM-2F5M...

@backstage/plugin-search-backend-module-techdocs (>=0.0.0-nightly-20260822023239, <=0.4.18-next.0), @backstage/plugin-techdocs-backend (>=0.0.0-nightly-20260827035829, <=2.2.3-next.1) +1 more potentially affected by CVE-2026-106455 via @backstage/plugin-techdocs-node (>=1.15.1-next.0, <=1.15.3)

@backstage/plugin-techdocs-node NPM version =1.15.1-next.0, =0.0.0-nightly-20260822023239, =0.0.0-nightly-20260827035829, =0.0.0-nightly-20260823023807, =1.11.4-next.0 Source cves: CVE-2026-106455 Source advisory: GHSA-Q38J-6VCM-2F5M...

EUVD-2026-93989

Backstage: Inconsistent credential enforcement for overlapping proxy routes...

Backstage: Inconsistent credential enforcement for overlapping proxy routes

Impact An operator can configure overlapping proxy paths with different credential requirements. When a parent path permits unauthenticated access and a nested path requires credentials, the parent exemption can also cover requests handled by the nested proxy. An unauthenticated caller may...

GHSA-472H-9C5J-PRRR Backstage: Inconsistent credential enforcement for overlapping proxy routes

Impact An operator can configure overlapping proxy paths with different credential requirements. When a parent path permits unauthenticated access and a nested path requires credentials, the parent exemption can also cover requests handled by the nested proxy. An unauthenticated caller may...

EUVD-2026-93992

Backstage: Inconsistent repository filtering in Bitbucket Server catalog event updates...

EUVD-2026-93993

Backstage: Improper input validation in Sentry scaffolder actions...

EUVD-2026-93995

Backstage: Explicit negative email verification can be ignored during shared OAuth profile normalization...

@backstage/backend-app-api (>=1.7.0-next.0, <=1.7.4-next.1), @backstage/backend-defaults (>=0.0.0-nightly-20260415031804, <=0.17.9-next.1) +113 more potentially affected by CVE-2026-106460 via @backstage/plugin-auth-node (>=0.7.0, <=0.7.5-next.1)

@backstage/plugin-auth-node NPM version =0.7.0, =1.7.0-next.0, =0.0.0-nightly-20260415031804, =0.0.0-nightly-20260415031804, =0.6.9-next.0, =1.9.1-next.0, =0.0.0-nightly-20260415031804, =0.0.0, =0.5.14-next.0, =0.1.45-next.0, =0.0.0-nightly-20260415031804, =0.4.15-next.0, =0.4.1-next.0,...

@alauda/dp-dynamic-plugin-backend-core (>=0.1.7, <=0.1.12), @alexandreamormino/plugin-entity-manager-backend (>=1.0.1, <=1.0.4) +594 more potentially affected by CVE-2026-106460 via @backstage/plugin-auth-node (>=0.4.17, <=0.6.15-next.0)

@backstage/plugin-auth-node NPM version =0.4.17, =0.1.7, =1.0.1, =0.4.5, =0.4.5, =0.5.5, =0.5.5, =0.3.10, =1.1.5, =1.0.0, =0.1.8, =2.0.6, =1.1.8, =0.2.8, =1.0.7, =0.2.6, =0.2.8 and more Source cves: CVE-2026-106460 Source advisory: OS...