@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20251122024148, <=0.8.7-next.0), @backstage/plugin-catalog-backend-module-github (>=0.10.1-next.1, <=0.11.1-next.1) +4 more potentially affected by CVE-2026-106496 via @backstage/plugin-catalog-backend (>=3.0.0-next.0, <=3.9.0)

@backstage/plugin-catalog-backend NPM version =3.0.0-next.0, =0.0.0-nightly-20251122024148, =0.10.1-next.1, =0.3.12-next.1, =0.0.0-nightly-20251123025211, =0.1.12-next.1, =0.1.0-next.0, =0.1.3-next.0 Source cves: CVE-2026-106496 Source advisory: GHSA-PCMQ-25R3-5W9V...

@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20251122024148, <=0.8.7-next.0), @backstage/plugin-catalog-backend-module-github (>=0.10.1-next.1, <=0.11.1-next.1) +4 more potentially affected by CVE-2026-106496 via @backstage/plugin-catalog-backend (>=3.0.0-next.0, <=3.9.0)

@backstage/plugin-catalog-backend NPM version =3.0.0-next.0, =0.0.0-nightly-20251122024148, =0.10.1-next.1, =0.3.12-next.1, =0.0.0-nightly-20251123025211, =0.1.12-next.1, =0.1.0-next.0, =0.1.3-next.0 Source cves: CVE-2026-106496 Source advisory: SNYK:JS-BACKSTAGEPLUGINCATALOGBACKEND-20825105...

Backstage: Inconsistent enforcement of allowed location types during catalog processing

Impact Under certain configurations, the catalog backend could process location types that were not intended to be allowed, potentially leading to unintended file access on the backend host. Patches Patched in @backstage/plugin-catalog-backend version 3.9.1 Workarounds No practical workarounds ar...

EUVD-2026-94052

Backstage: Inconsistent enforcement of allowed location types during catalog processing...

GHSA-PCMQ-25R3-5W9V Backstage: Inconsistent enforcement of allowed location types during catalog processing

Impact Under certain configurations, the catalog backend could process location types that were not intended to be allowed, potentially leading to unintended file access on the backend host. Patches Patched in @backstage/plugin-catalog-backend version 3.9.1 Workarounds No practical workarounds ar...

GHSA-QGVJ-QCF8-XQ73 Backstage: Improper URL validation in catalog entity placeholder resolution

Impact An authenticated Backstage user could craft a catalog entity with placeholder directives that reference resources outside the entity's source repository. Under certain configurations, this could allow access to data not intended to be available to the user. Patches Patched in...

@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20251122024148, <=0.8.7-next.0), @backstage/plugin-catalog-backend-module-github (>=0.10.1-next.1, <=0.11.1-next.1) +4 more potentially affected by CVE-2026-106498 via @backstage/plugin-catalog-backend (>=3.0.0-next.0, <=3.9.0)

@backstage/plugin-catalog-backend NPM version =3.0.0-next.0, =0.0.0-nightly-20251122024148, =0.10.1-next.1, =0.3.12-next.1, =0.0.0-nightly-20251123025211, =0.1.12-next.1, =0.1.0-next.0, =0.1.3-next.0 Source cves: CVE-2026-106498 Source advisory: SNYK:JS-BACKSTAGEPLUGINCATALOGBACKEND-20825104...

@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20251122024148, <=0.8.7-next.0), @backstage/plugin-catalog-backend-module-github (>=0.10.1-next.1, <=0.11.1-next.1) +4 more potentially affected by CVE-2026-106498 via @backstage/plugin-catalog-backend (>=3.0.0-next.0, <=3.9.0)

@backstage/plugin-catalog-backend NPM version =3.0.0-next.0, =0.0.0-nightly-20251122024148, =0.10.1-next.1, =0.3.12-next.1, =0.0.0-nightly-20251123025211, =0.1.12-next.1, =0.1.0-next.0, =0.1.3-next.0 Source cves: CVE-2026-106498 Source advisory: GHSA-QGVJ-QCF8-XQ73...

Server-side Request Forgery (SSRF)

Overview @backstage/plugin-catalog-backend is a The Backstage backend plugin that provides the Backstage catalog Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the relativeUrl function in PlaceholderProcessor.ts, where a catalog entity placeholder value...

EUVD-2026-94056

Backstage: Improper URL validation in catalog entity placeholder resolution...

@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20251122024148, <=0.8.7-next.0), @backstage/plugin-catalog-backend-module-github (>=0.10.1-next.1, <=0.11.1-next.1) +4 more potentially affected by CVE-2026-106498 via @backstage/plugin-catalog-backend (>=3.0.0-next.0, <=3.9.0)

@backstage/plugin-catalog-backend NPM version =3.0.0-next.0, =0.0.0-nightly-20251122024148, =0.10.1-next.1, =0.3.12-next.1, =0.0.0-nightly-20251123025211, =0.1.12-next.1, =0.1.0-next.0, =0.1.3-next.0 Source cves: CVE-2026-106498 Source advisory: OSV:GHSA-QGVJ-QCF8-XQ73...

EUVD-2026-94059

Backstage: Sensitive information exposure in Scaffolder...

Insertion of Sensitive Information Into Sent Data

Overview @backstage/plugin-scaffolder-backend is a The Backstage backend plugin that helps you create new things Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data via the task serialization logic in router.ts, which previously included secrets a...

Insertion of Sensitive Information into Log File

Overview @backstage/plugin-scaffolder-backend is a The Backstage backend plugin that helps you create new things Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File via the NunjucksWorkflowRunner in NunjucksWorkflowRunner.ts, where secret values...

EUVD-2026-94057

Backstage: Secret-derived values may be exposed in scaffolder task logs...

GHSA-MFVQ-X7VR-RGQG Backstage: Secret-derived values may be exposed in scaffolder task logs

Impact Deployments that configure sensitive scaffolder.defaultEnvironment.secrets and allow an attacker to create or modify Scaffolder templates are affected. A template author could cause secret-derived values used during template iteration to be persisted in task logs, exposing those values to...

GHSA-HMP2-4M7G-22CV Backstage: Scaffolder action input authorization bypass

Impact An authenticated user with access to affected Scaffolder templates could bypass configured action restrictions. Depending on integration credentials, this could grant unauthorized access to repositories and related source-control resources. Patches Patched in...

Backstage: Scaffolder action input authorization bypass

Impact An authenticated user with access to affected Scaffolder templates could bypass configured action restrictions. Depending on integration credentials, this could grant unauthorized access to repositories and related source-control resources. Patches Patched in...

EUVD-2026-94068

Backstage: Scaffolder action input authorization bypass...

Improper Handling of Case Sensitivity

Overview @backstage/plugin-scaffolder-backend is a The Backstage backend plugin that helps you create new things Affected versions of this package are vulnerable to Improper Handling of Case Sensitivity via isActionAuthorized in NunjucksWorkflowRunner.ts, where numeric or numeric-string values...