EUVD-2026-94052

Backstage: Inconsistent enforcement of allowed location types during catalog processing...

GHSA-QGVJ-QCF8-XQ73 Backstage: Improper URL validation in catalog entity placeholder resolution

Impact An authenticated Backstage user could craft a catalog entity with placeholder directives that reference resources outside the entity's source repository. Under certain configurations, this could allow access to data not intended to be available to the user. Patches Patched in...

Server-side Request Forgery (SSRF)

Overview @backstage/plugin-catalog-backend is a The Backstage backend plugin that provides the Backstage catalog Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the relativeUrl function in PlaceholderProcessor.ts, where a catalog entity placeholder value...

EUVD-2026-94056

Backstage: Improper URL validation in catalog entity placeholder resolution...

EUVD-2026-94059

Backstage: Sensitive information exposure in Scaffolder...

Insertion of Sensitive Information Into Sent Data

Overview @backstage/plugin-scaffolder-backend is a The Backstage backend plugin that helps you create new things Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data via the task serialization logic in router.ts, which previously included secrets a...

Insertion of Sensitive Information into Log File

Overview @backstage/plugin-scaffolder-backend is a The Backstage backend plugin that helps you create new things Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File via the NunjucksWorkflowRunner in NunjucksWorkflowRunner.ts, where secret values...

GHSA-MFVQ-X7VR-RGQG Backstage: Secret-derived values may be exposed in scaffolder task logs

Impact Deployments that configure sensitive scaffolder.defaultEnvironment.secrets and allow an attacker to create or modify Scaffolder templates are affected. A template author could cause secret-derived values used during template iteration to be persisted in task logs, exposing those values to...

EUVD-2026-94057

Backstage: Secret-derived values may be exposed in scaffolder task logs...

GHSA-HMP2-4M7G-22CV Backstage: Scaffolder action input authorization bypass

Impact An authenticated user with access to affected Scaffolder templates could bypass configured action restrictions. Depending on integration credentials, this could grant unauthorized access to repositories and related source-control resources. Patches Patched in...

Backstage: Scaffolder action input authorization bypass

Impact An authenticated user with access to affected Scaffolder templates could bypass configured action restrictions. Depending on integration credentials, this could grant unauthorized access to repositories and related source-control resources. Patches Patched in...

EUVD-2026-94068

Backstage: Scaffolder action input authorization bypass...

Improper Handling of Case Sensitivity

Overview @backstage/plugin-scaffolder-backend is a The Backstage backend plugin that helps you create new things Affected versions of this package are vulnerable to Improper Handling of Case Sensitivity via isActionAuthorized in NunjucksWorkflowRunner.ts, where numeric or numeric-string values...

Race Condition

Overview @backstage/plugin-scaffolder-backend is a The Backstage backend plugin that helps you create new things Affected versions of this package are vulnerable to Race Condition via the retryTask method in DatabaseTaskStore.ts, where a task retry operation is performed without first validating...

Backstage: Improper task state validation in Scaffolder backend

Impact An authenticated user with permission to create and access Scaffolder tasks may, under specific timing and deployment conditions, affect files accessible to the Backstage backend. If backend application files are writable, the confidentiality, integrity, and availability of the backend may...

EUVD-2026-94058

Backstage: Improper task state validation in Scaffolder backend...

Backstage: Incorrect authorization in scaffolder task listing

Impact An authenticated internal user may be able to view metadata for scaffolder tasks outside the visibility intended by a deployment's permission policy. Stored task secrets are not included in the affected response, and no integrity or availability impact was identified. Patches Patched in...

EUVD-2026-93996

Backstage: Incorrect authorization in scaffolder task listing...

Incorrect Authorization

Overview @backstage/plugin-scaffolder-backend is a The Backstage backend plugin that helps you create new things Affected versions of this package are vulnerable to Incorrect Authorization via the getAuthorizeConditions function in checkPermissions.ts, which fails to enforce DENY authorization...

CVE-2026-106487

A flaw was found in the plugin-kubernetes-backend component of Backstage. In environments configured for catalog cluster discovery, an authenticated catalog contributor can define an unsupported authentication mode on cluster resource entities. This vulnerability allows the backend to query the...