GHSA-QMW3-745M-W99G Backstage: Improper validation of TechDocs MkDocs configuration

Impact An attacker who can provide configuration to a TechDocs build may execute code in the generator runtime. Impact is greatest when documentation generation runs with backend credentials or host access. Patches Patched in @backstage/plugin-techdocs-node version 1.15.4. Workarounds Use externa...

Deserialization of Untrusted Data

Overview @backstage/plugin-techdocs-node is a Common node.js functionalities for TechDocs, to be shared between techdocs-backend plugin and techdocs-cli Affected versions of this package are vulnerable to Deserialization of Untrusted Data in sanitizeMkdocsYml within mkdocsPatchers.ts via malforme...

@backstage/plugin-search-backend-module-techdocs (0.4.19-next.0), @backstage/plugin-techdocs-backend (2.3.1-next.0) +1 more potentially affected by CVE-2026-106558 via @backstage/plugin-techdocs-node (2.0.1-next.0)

@backstage/plugin-techdocs-node NPM version 2.0.1-next.0 is affected by a known vulnerability. The following packages have a transitive dependency on @backstage/plugin-techdocs-node and may be impacted: - @backstage/plugin-search-backend-module-techdocs 0.4.19-next.0 -...

External Control of File Name or Path

Overview @backstage/plugin-scaffolder-backend-module-confluence-to-markdown is a The confluence-to-markdown module for @backstage/plugin-scaffolder-backend Affected versions of this package are vulnerable to External Control of File Name or Path via the getAndWriteAttachments function in...

Directory Traversal

Overview @backstage/plugin-scaffolder-backend-module-confluence-to-markdown is a The confluence-to-markdown module for @backstage/plugin-scaffolder-backend Affected versions of this package are vulnerable to Directory Traversal via parsedRepoUrl.filepath in confluenceToMarkdown.ts, where...

Backstage: Improper repository path validation in a Scaffolder backend module

Impact An authenticated user who can execute an affected template and control its repository file location may cause generated content to be written outside the task workspace, within locations writable by the Backstage backend process. Patches Patched in...

Incorrect Authorization

Overview @backstage/plugin-search-backend-module-elasticsearch is an A module for the search backend that implements search using ElasticSearch Affected versions of this package are vulnerable to Incorrect Authorization in AuthorizedSearchEngine when all document types are denied by authorization...

Backstage has incorrect authorization in search engine permission filtering

Impact An authenticated Backstage user subject to a DENY policy for search document types could receive search results they were not authorized to view. This affects deployments with permission.enabled: true and an Elasticsearch or OpenSearch search backend. Patches - Upgrade...

Incorrect Authorization

Overview @backstage/plugin-search-backend is a The Backstage backend plugin that provides your backstage app with search Affected versions of this package are vulnerable to Incorrect Authorization in AuthorizedSearchEngine when all document types are denied by authorization policy. An authenticat...

@backstage/plugin-kubernetes (>=0.0.0-nightly-202010102951, <=0.4.2), @devangelista/backstage-scaffolder-kubernetes (>=0.4.0, <=0.5.0) +3 more potentially affected by CVE-2026-106563 via @backstage/plugin-kubernetes-backend (>=0.0.0-nightly-20261031021925, <=0.20.4)

@backstage/plugin-kubernetes-backend NPM version =0.0.0-nightly-20261031021925, =0.0.0-nightly-202010102951, =0.4.0, =1.0.0, =1.1.0, =1.15.1, =2.9.1 Source cves: CVE-2026-106563 Source advisory: SNYK:JS-BACKSTAGEPLUGINKUBERNETESBACKEND-20826427...

@backstage/plugin-kubernetes (>=0.0.0-nightly-202010102951, <=0.4.2), @devangelista/backstage-scaffolder-kubernetes (>=0.4.0, <=0.5.0) +3 more potentially affected by CVE-2026-106563 via @backstage/plugin-kubernetes-backend (>=0.0.0-nightly-20261031021925, <=0.20.4)

@backstage/plugin-kubernetes-backend NPM version =0.0.0-nightly-20261031021925, =0.0.0-nightly-202010102951, =0.4.0, =1.0.0, =1.1.0, =1.15.1, =2.9.1 Source cves: CVE-2026-106563 Source advisory: GHSA-R9PH-3637-55PX...

@backstage/plugin-kubernetes (>=0.0.0-nightly-202010102951, <=0.4.2), @devangelista/backstage-scaffolder-kubernetes (>=0.4.0, <=0.5.0) +3 more potentially affected by CVE-2026-106563 via @backstage/plugin-kubernetes-backend (>=0.0.0-nightly-20261031021925, <=0.20.4)

@backstage/plugin-kubernetes-backend NPM version =0.0.0-nightly-20261031021925, =0.0.0-nightly-202010102951, =0.4.0, =1.0.0, =1.1.0, =1.15.1, =2.9.1 Source cves: CVE-2026-106563 Source advisory: OSV:GHSA-R9PH-3637-55PX...

Missing Authorization

Overview @backstage/plugin-kubernetes-backend is an A Backstage backend plugin that integrates towards Kubernetes Affected versions of this package are vulnerable to Missing Authorization via the Kubernetes objects endpoint in KubernetesRouter, where the entity field supplied in the request body ...

GHSA-P795-MQF2-36MF Backstage has a sensitive information disclosure in Kubernetes resource queries

Impact An authenticated user holding the standard Kubernetes resource read permission could retrieve sensitive values that the Kubernetes plugin is designed to mask, potentially exposing credentials and other confidential material held in the connected clusters. Exposure is limited to resources...

Incorrect Authorization

Overview @backstage/plugin-kubernetes-backend is an A Backstage backend plugin that integrates towards Kubernetes Affected versions of this package are vulnerable to Incorrect Authorization via the sanitizeKubernetesResponse method in KubernetesFetcher.ts, where Kubernetes Secret values are not...

@backstage/plugin-kubernetes (>=0.0.0-nightly-202010102951, <=0.4.2), @devangelista/backstage-scaffolder-kubernetes (>=0.4.0, <=0.5.0) +3 more potentially affected by CVE-2026-106561 via @backstage/plugin-kubernetes-backend (>=0.0.0-nightly-20261031021925, <=0.20.4)

@backstage/plugin-kubernetes-backend NPM version =0.0.0-nightly-20261031021925, =0.0.0-nightly-202010102951, =0.4.0, =1.0.0, =1.1.0, =1.15.1, =2.9.1 Source cves: CVE-2026-106561 Source advisory: GHSA-P795-MQF2-36MF...

@backstage/plugin-kubernetes (>=0.0.0-nightly-202010102951, <=0.4.2), @devangelista/backstage-scaffolder-kubernetes (>=0.4.0, <=0.5.0) +3 more potentially affected by CVE-2026-106561 via @backstage/plugin-kubernetes-backend (>=0.0.0-nightly-20261031021925, <=0.20.4)

@backstage/plugin-kubernetes-backend NPM version =0.0.0-nightly-20261031021925, =0.0.0-nightly-202010102951, =0.4.0, =1.0.0, =1.1.0, =1.15.1, =2.9.1 Source cves: CVE-2026-106561 Source advisory: SNYK:JS-BACKSTAGEPLUGINKUBERNETESBACKEND-20826149...

@backstage/plugin-kubernetes (>=0.0.0-nightly-202010102951, <=0.4.2), @devangelista/backstage-scaffolder-kubernetes (>=0.4.0, <=0.5.0) +3 more potentially affected by CVE-2026-106561 via @backstage/plugin-kubernetes-backend (>=0.0.0-nightly-20261031021925, <=0.20.4)

@backstage/plugin-kubernetes-backend NPM version =0.0.0-nightly-20261031021925, =0.0.0-nightly-202010102951, =0.4.0, =1.0.0, =1.1.0, =1.15.1, =2.9.1 Source cves: CVE-2026-106561 Source advisory: OSV:GHSA-P795-MQF2-36MF...

@backstage/plugin-scaffolder-backend (>=0.0.0-nightly-20240207020916, <=3.1.3-next.2), @backstage/plugin-scaffolder-backend-module-bitbucket (>=0.0.0-nightly-20240207020916, <=0.3.20-next.0) potentially affected by CVE-2026-106462 via @backstage/plugin-scaffolder-backend-module-bitbucket-server (>=0.0.0-nightly-20240929023448, <=0.2.19-next.0)

@backstage/plugin-scaffolder-backend-module-bitbucket-server NPM version =0.0.0-nightly-20240929023448, =0.0.0-nightly-20240207020916, =0.0.0-nightly-20240207020916, =0.3.20-next.0 Source cves: CVE-2026-106462 Source advisory: SNYK:JS-BACKSTAGEPLUGINSCAFFOLDERBACKENDMODULEBITBUCKETSERVER-20825384...

@alithya-oss/backstage-plugin-scaffolder-backend-module-aws-apps (>=0.3.10, <=0.3.12), @alithya-oss/plugin-scaffolder-backend-module-aws-apps (>=0.3.6, <=0.3.9) +55 more potentially affected by CVE-2026-106462 via @backstage/plugin-scaffolder-backend-module-bitbucket-cloud (>=0.0.0-nightly-20240929023448, <=0.3.4-next.0)

@backstage/plugin-scaffolder-backend-module-bitbucket-cloud NPM version =0.0.0-nightly-20240929023448, =0.3.10, =0.3.6, =0.1.0, =0.4.0, =0.0.0-nightly-20240207020916, =0.0.0-nightly-20240207020916, =0.2.5, =0.3.5, =0.1.0, =0.2.3, =0.4.3, =0.1.10, =0.1.14 -...