CVE-2026-106496: Improper Limitation of a Pathname to a Restricted Directory

Backstage is an open framework for building developer portals. Prior to 3.9.1, the @backstage/plugin-catalog-backend package is affected by inconsistent enforcement of allowed location types during catalog processing. Under certain configurations, the catalog backend could process location types...

CVE-2026-88064

Backstage is an open framework for building developer portals. Prior to 1.14.6 and from 1.15.0 until 1.15.4, the @backstage/plugin-techdocs-node package insufficiently validates mkdocs.yml supplied by an authenticated user who can register or modify a TechDocs source. Unsafe Python YAML tags,...

@backstage/plugin-search-backend-module-techdocs (>=0.0.0-nightly-20260415031804, <=0.4.14-next.0), @backstage/plugin-techdocs-backend (>=0.0.0-nightly-2021111822616, <=2.1.8-next.0) +2 more potentially affected by CVE-2026-88064 via @backstage/plugin-techdocs-node (>=0.11.12, <=1.14.6-next.0)

@backstage/plugin-techdocs-node NPM version =0.11.12, =0.0.0-nightly-20260415031804, =0.0.0-nightly-2021111822616, =0.11.12-next.0, =0.0.0-nightly-2021111822616, =1.10.8-next.0 Source cves: CVE-2026-88064 Source advisory: MEND:CVE-2026-88064...

CVE-2026-88064

Backstage is an open framework for building developer portals. Prior to 1.14.6 and from 1.15.0 until 1.15.4, the @backstage/plugin-techdocs-node package insufficiently validates mkdocs.yml supplied by an authenticated user who can register or modify a TechDocs source. Unsafe Python YAML tags,...

@backstage/plugin-search-backend-module-techdocs (>=0.0.0-nightly-20260822023239, <=0.4.18-next.0), @backstage/plugin-techdocs-backend (>=0.0.0-nightly-20260827035829, <=2.2.3-next.1) +1 more potentially affected by CVE-2026-88064 via @backstage/plugin-techdocs-node (>=1.15.1-next.0, <=1.15.3)

@backstage/plugin-techdocs-node NPM version =1.15.1-next.0, =0.0.0-nightly-20260822023239, =0.0.0-nightly-20260827035829, =0.0.0-nightly-20260823023807, =1.11.4-next.0 Source cves: CVE-2026-88064 Source advisory: MEND:CVE-2026-88064...

CVE-2026-88064: Improper Input Validation

Backstage is an open framework for building developer portals. Prior to 1.14.6 and from 1.15.0 until 1.15.4, the @backstage/plugin-techdocs-node package insufficiently validates mkdocs.yml supplied by an authenticated user who can register or modify a TechDocs source. Unsafe Python YAML tags,...

PT-2026-93759

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 1.14.6 Backstage versions 1.15.0 through 1.15.4 Description The @backstage/plugin-techdocs-node package insufficiently validates the mkdocs.yml file provided by an authenticated user with permissions to register or...

@jamietanna/renovate-graph (>=0.24.0, <=0.30.0), @secustor/backstage-plugin-renovate-backend-module-runtime-direct (>=0.6.5, <=1.0.1) potentially affected by CVE-2026-76229 via renovate (>=39.230.2, <=40.21.2)

renovate NPM version =39.230.2, =0.24.0, =0.6.5, =1.0.1 Source cves: CVE-2026-76229 Source advisory: MEND:CVE-2026-76229...

@jamietanna/renovate-graph (>=0.36.0, <=0.37.0), @secustor/backstage-plugin-renovate-backend-module-runtime-direct (3.1.1) potentially affected by CVE-2026-76227 via renovate (>=42.92.4, <=42.99.0)

renovate NPM version =42.92.4, =0.36.0, =0.37.0 - @secustor/backstage-plugin-renovate-backend-module-runtime-direct 3.1.1 Source cves: CVE-2026-76227 Source advisory: MEND:CVE-2026-76227...

@secustor/backstage-plugin-renovate-backend-module-runtime-direct (4.0.1) potentially affected by CVE-2026-76226 via renovate (43.77.2)

renovate NPM version 43.77.2 is affected by a known vulnerability. The following packages have a transitive dependency on renovate and may be impacted: - @secustor/backstage-plugin-renovate-backend-module-runtime-direct 4.0.1 Source cves: CVE-2026-76226 Source advisory: MEND:CVE-2026-76226...

@backstage/plugin-auth-backend (>=0.0.0-nightly-20240122021809, <=0.22.11), @backstage/plugin-auth-backend-module-aws-alb-provider (>=0.0.0-nightly-20240126021148, <=0.4.18-next.0) +12 more potentially affected by CVE-2026-73563 via @backstage/plugin-auth-backend (>=0.0.0-nightly-20240929023448, <=0.29.2-next.0)

@backstage/plugin-auth-backend NPM version =0.0.0-nightly-20240929023448, =0.0.0-nightly-20240122021809, =0.0.0-nightly-20240126021148, =0.0.0-nightly-20240122021809, =0.0.0-nightly-202201422556, =0.0.0-nightly-202111222339, =0.0.0-nightly-2021102522541, =0.0.0-nightly-20220203021748,...

CVE-2026-73563

Backstage is an open framework for building developer portals. Prior to 0.29.2, the experimental dynamic client registration and client ID metadata document features in the @backstage/plugin-auth-backend use full-string matcher.isMatch glob matching for...

CVE-2026-73563: URL Redirection to Untrusted Site

Backstage is an open framework for building developer portals. Prior to 0.29.2, the experimental dynamic client registration and client ID metadata document features in the @backstage/plugin-auth-backend use full-string matcher.isMatch glob matching for...

Open Redirect

Overview @backstage/plugin-auth-backend is an A Backstage backend plugin that handles authentication Affected versions of this package are vulnerable to Open Redirect via the allowlist matching process. An attacker can intercept authorization codes by registering an OAuth client with a crafted...

@backstage/plugin-auth-backend (>=0.0.0-nightly-20240122021809, <=0.22.11), @backstage/plugin-auth-backend-module-aws-alb-provider (>=0.0.0-nightly-20240126021148, <=0.4.17-next.0) +12 more potentially affected by CVE-2026-73563 via @backstage/plugin-auth-backend (>=0.0.0-nightly-20240929023448, <=0.29.1-next.0)

@backstage/plugin-auth-backend NPM version =0.0.0-nightly-20240929023448, =0.0.0-nightly-20240122021809, =0.0.0-nightly-20240126021148, =0.0.0-nightly-20240122021809, =0.0.0-nightly-202201422556, =0.0.0-nightly-202111222339, =0.0.0-nightly-2021102522541, =0.0.0-nightly-20220203021748,...

@backstage/plugin-auth-backend (>=0.0.0-nightly-20240122021809, <=0.22.11), @backstage/plugin-auth-backend-module-aws-alb-provider (>=0.0.0-nightly-20240126021148, <=0.4.18-next.0) +12 more potentially affected by CVE-2026-73563 via @backstage/plugin-auth-backend (>=0.0.0-nightly-20240929023448, <=0.29.2-next.0)

@backstage/plugin-auth-backend NPM version =0.0.0-nightly-20240929023448, =0.0.0-nightly-20240122021809, =0.0.0-nightly-20240126021148, =0.0.0-nightly-20240122021809, =0.0.0-nightly-202201422556, =0.0.0-nightly-202111222339, =0.0.0-nightly-2021102522541, =0.0.0-nightly-20220203021748,...

@backstage/plugin-auth-backend (>=0.0.0-nightly-20240122021809, <=0.22.11), @backstage/plugin-auth-backend-module-aws-alb-provider (>=0.0.0-nightly-20240126021148, <=0.4.18-next.0) +12 more potentially affected by unknown CVE via @backstage/plugin-auth-backend (>=0.0.0-nightly-20240929023448, <=0.29.2-next.0)

@backstage/plugin-auth-backend NPM version =0.0.0-nightly-20240929023448, =0.0.0-nightly-20240122021809, =0.0.0-nightly-20240126021148, =0.0.0-nightly-20240122021809, =0.0.0-nightly-202201422556, =0.0.0-nightly-202111222339, =0.0.0-nightly-2021102522541, =0.0.0-nightly-20220203021748,...

GHSA-38HQ-7X33-PHP4 @backstage/plugin-auth-backend: Unauthenticated OAuth account takeover via `redirect_uri` allowlist bypass

Impact The allowlist matching used by the experimental dynamic client registration and client ID metadata document CIMD features in @backstage/plugin-auth-backend matched glob patterns against the full URL string. A wildcard could therefore match across URL component boundaries: a pattern such as...

PT-2026-67470

Impact The allowlist matching used by the experimental dynamic client registration and client ID metadata document CIMD features in @backstage/plugin-auth-backend matched glob patterns against the full URL string. A wildcard could therefore match across URL component boundaries: a pattern such as...

PT-2026-71711

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 0.29.2 Description Experimental dynamic client registration and client ID metadata document features in the @backstage/plugin-auth-backend use full-string matcher.isMatch glob matching for the...