CVE-2026-115923

The Backstage framework (an open framework for building developer portals) is affected by a vulnerability in the @backstage/plugin-catalog-backend component. Specifically, the DefaultCatalogRulesEnforcer compares the raw location.target URL against catalog.rules, but URL readers canonicalize the ...

CVE-2026-115923 Backstage catalog rules can be bypassed for URL locations using encoded path segments

Backstage is an open framework for building developer portals. Prior to 3.9.2 and from 4.0.0 until 4.0.2, DefaultCatalogRulesEnforcer in @backstage/plugin-catalog-backend compares the raw location.target URL against catalog.rules, while URL readers canonicalize the same URL before fetching it. An...