Plugin catalog backend module azure: Backstage: Cloud storage catalog locations may cross configured storage boundaries (CVE-2026-106493)

Catalog entity providers for Azure Blob Storage and AWS S3 in Backstage did not sufficiently validate storage object paths, enabling catalog descriptors to be read from outside the configured storage boundaries. Access is constrained to locations reachable by the backend's configured credentials. This vulnerability is identified as CVE-2026-106493 and is classified under CWE-22 (Path Traversal). It affects versions of @backstage/plugin-catalog-backend-module-azure prior to 0.3.21, @backstage/plugin-catalog-backend-module-aws prior to 0.4.27, and @backstage/backend-defaults prior to 0.7.18. The CVSS v3.1 base score is 3.0, reflecting low severity with network attack vector, high attack complexity, and requiring high privileges.

An attacker with access to the backend's configured credentials could read catalog descriptors from storage locations outside the intended boundaries. This could lead to unauthorized disclosure of catalog data limited to accessible storage locations. There is no indication of integrity or availability impact. The overall impact is limited by the need for high privileges and network access.

A fix is available in versions 0.3.21 and later for @backstage/plugin-catalog-backend-module-azure, 0.4.27 and later for @backstage/plugin-catalog-backend-module-aws, and 0.7.18 and later for @backstage/backend-defaults. Users should upgrade to these versions to remediate the vulnerability. Additionally, restrict blob and object creation or renaming in catalog storage sources to trusted principals, scope Azure and AWS reader credentials and network access to intended storage boundaries, and disable affected catalog providers if these restrictions cannot be enforced.