CVE-2026-106487

The @backstage/plugin-kubernetes-backend package in the Backstage framework (prior to version 0.21.10 ) is vulnerable to an Unintended Proxy or Intermediary ('Confused Deputy') flaw. The root cause is that the CatalogClusterLocator silently accepts cluster entities annotated with a serviceAccount...