Plugin catalog backend: Backstage: Improper URL validation in catalog entity placeholder resolution (CVE-2026-106498)
Description
An authenticated user of the Backstage plugin-catalog-backend could exploit improper URL validation in catalog entity placeholder resolution to reference resources outside the intended repository. This vulnerability could allow access to data not meant to be accessible under certain configurations. The issue is patched in version 3.9.1 of the plugin.
CVSS v3.1
Score 7.7high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-106498 describes an improper URL validation vulnerability in the Backstage plugin-catalog-backend component. Authenticated users can craft catalog entities with placeholder directives that reference external resources beyond the entity's source repository. This behavior, under specific configurations, may lead to unauthorized access to data. The vulnerability is addressed by updating to version 3.9.1 of @backstage/plugin-catalog-backend.
Potential Impact
The vulnerability allows an authenticated user to potentially access data outside the intended repository scope, which could lead to unauthorized data exposure. The CVSS score of 7.7 (high) reflects the network attack vector, low attack complexity, and high confidentiality impact without integrity or availability impact.
Mitigation Recommendations
Upgrade to @backstage/plugin-catalog-backend version 3.9.1 or later to apply the official fix. If immediate upgrade is not possible, limit the scope of integration credentials such as GitHub tokens to only the repositories that Backstage requires access to, reducing the risk of unauthorized data exposure.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-qgvj-qcf8-xq73
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-106498"]
- Ecosystems
- ["npm"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6ac6c0012cdf04f6568291bb
Added to database: 10/07/2026, 21:56:17 UTC
Last enriched: 10/07/2026, 22:15:23 UTC
Last updated: 10/07/2026, 22:15:23 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.