CVE-2026-106488 Backstage: Improper authentication in the OIDC provider

Backstage is an open framework for building developer portals. Prior to 0.4.20, the @backstage/plugin-auth-backend-module-oidc-provider package is affected by improper authentication in the oidc provider. Deployments using OIDC email-based identity resolution with a provider that permits unverifi...

CVE-2026-106488

The Backstage framework is vulnerable to improper authentication in the @backstage/plugin-auth-backend-module-oidc-provider package in versions prior to 0.4.20 . When using OIDC email-based identity resolution with a provider that allows unverified email addresses, an authenticated provider user ...

CVE-2026-106488 Backstage: Improper authentication in the OIDC provider

Backstage is an open framework for building developer portals. Prior to 0.4.20, the @backstage/plugin-auth-backend-module-oidc-provider package is affected by improper authentication in the oidc provider. Deployments using OIDC email-based identity resolution with a provider that permits unverifi...

CVE-2026-106487

Backstage is an open framework for building developer portals. Prior to 0.21.10, the @backstage/plugin-kubernetes-backend package is affected by unsupported catalog cluster authentication mode in kubernetes backend. Deployments using catalog cluster discovery may be affected when catalog...

CVE-2026-106487

The @backstage/plugin-kubernetes-backend package in Backstage (prior to version 0.21.10 ) is vulnerable to an unsupported catalog cluster authentication mode in the Kubernetes backend. If catalog contributors can modify kubernetes-cluster Resource entities , the backend might use its local in-clu...

CVE-2026-106487 Backstage: Unsupported catalog cluster authentication mode in kubernetes backend

Backstage is an open framework for building developer portals. Prior to 0.21.10, the @backstage/plugin-kubernetes-backend package is affected by unsupported catalog cluster authentication mode in kubernetes backend. Deployments using catalog cluster discovery may be affected when catalog...

CVE-2026-106487 Backstage: Unsupported catalog cluster authentication mode in kubernetes backend

Backstage is an open framework for building developer portals. Prior to 0.21.10, the @backstage/plugin-kubernetes-backend package is affected by unsupported catalog cluster authentication mode in kubernetes backend. Deployments using catalog cluster discovery may be affected when catalog...

CVE-2026-106487 Backstage: Unsupported catalog cluster authentication mode in kubernetes backend

Backstage is an open framework for building developer portals. Prior to 0.21.10, the @backstage/plugin-kubernetes-backend package is affected by unsupported catalog cluster authentication mode in kubernetes backend. Deployments using catalog cluster discovery may be affected when catalog...

CVE-2026-106486 Backstage: Improper filesystem validation in Bitbucket pull-request scaffolder actions

Backstage is an open framework for building developer portals. Prior to 0.3.10 in @backstage/plugin-scaffolder-backend-module-bitbucket-cloud and 0.2.25 in @backstage/plugin-scaffolder-backend-module-bitbucket-server, the Bitbucket pull-request Scaffolder actions did not sufficiently validate...

CVE-2026-106486

Backstage is an open framework for building developer portals. Prior to 0.3.10 in @backstage/plugin-scaffolder-backend-module-bitbucket-cloud and 0.2.25 in @backstage/plugin-scaffolder-backend-module-bitbucket-server, the Bitbucket pull-request Scaffolder actions did not sufficiently validate...

CVE-2026-106486

The Backstage framework contains a vulnerability in its Bitbucket pull-request Scaffolder actions due to improper filesystem path validation . Specifically, versions prior to 0.3.10 in @backstage/plugin-scaffolder-backend-module-bitbucket-cloud and 0.2.25 in @backstage/plugin-scaffolder-backend-m...

CVE-2026-106463

Backstage is an open framework for building developer portals. Prior to 0.8.7, the @backstage/plugin-catalog-backend-module-gitlab package is affected by improper authorization in gitlab organizational user ingestion. Deployments that enable GitLab organization event ingestion and rely on scoped...

CVE-2026-106463 Backstage: Improper authorization in GitLab organizational user ingestion

Backstage is an open framework for building developer portals. Prior to 0.8.7, the @backstage/plugin-catalog-backend-module-gitlab package is affected by improper authorization in gitlab organizational user ingestion. Deployments that enable GitLab organization event ingestion and rely on scoped...

CVE-2026-106463 Backstage: Improper authorization in GitLab organizational user ingestion

Backstage is an open framework for building developer portals. Prior to 0.8.7, the @backstage/plugin-catalog-backend-module-gitlab package is affected by improper authorization in gitlab organizational user ingestion. Deployments that enable GitLab organization event ingestion and rely on scoped...

CVE-2026-106463

The Backstage framework is vulnerable to improper authorization in the @backstage/plugin-catalog-backend-module-gitlab package prior to version 0.8.7 . The flaw occurs during GitLab organizational user ingestion ; deployments enabling GitLab organization event ingestion that rely on scoped catalo...

CVE-2026-106463 Backstage: Improper authorization in GitLab organizational user ingestion

Backstage is an open framework for building developer portals. Prior to 0.8.7, the @backstage/plugin-catalog-backend-module-gitlab package is affected by improper authorization in gitlab organizational user ingestion. Deployments that enable GitLab organization event ingestion and rely on scoped...

CVE-2026-106461 Backstage: Incorrect authorization in scaffolder task listing

Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by incorrect authorization in scaffolder task listing. An authenticated internal user may be able to view metadata for scaffolder tasks outside the visibilit...

CVE-2026-106461

The Backstage open framework for developer portals contains an incorrect authorization vulnerability in the @backstage/plugin-scaffolder-backend package prior to version 4.1.0 . An authenticated internal user can view metadata for scaffolder tasks that fall outside the visibility defined by a dep...

CVE-2026-106461 Backstage: Incorrect authorization in scaffolder task listing

Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by incorrect authorization in scaffolder task listing. An authenticated internal user may be able to view metadata for scaffolder tasks outside the visibilit...

CVE-2026-106461

Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by incorrect authorization in scaffolder task listing. An authenticated internal user may be able to view metadata for scaffolder tasks outside the visibilit...