Plugin kubernetes backend: Backstage has a sensitive information disclosure in Kubernetes resource queries (CVE-2026-106561)

CVE-2026-106561 describes a sensitive information disclosure vulnerability in the @backstage/plugin-kubernetes-backend. Authenticated users with standard Kubernetes resource read permissions can retrieve sensitive values that the plugin is designed to mask. The exposure is constrained to resources readable by the Backstage service account and scoped by the catalog entity's namespace and label selector. The vulnerability affects versions prior to 0.21.9. The fix in 0.21.9 includes masking data fields of custom resources reported as SecretList by the API server, aligning with existing handling of core Kubernetes Secrets.

An attacker with authenticated Kubernetes resource read permissions could access sensitive information such as credentials and confidential data from Kubernetes resources that the plugin should mask. This could lead to unauthorized disclosure of sensitive cluster information. However, the impact is limited by the permissions of the Backstage service account and the namespace and label selector scoping. Deployments with restricted cluster credentials that do not allow reading these resources are not affected.

A patch is available and should be applied by upgrading to @backstage/plugin-kubernetes-backend version 0.21.9 or later. Additionally, enabling the permission framework and restricting the 'kubernetes.resources.read' permission to trusted users can mitigate risk. It is also recommended to scope the RBAC permissions of the service account used to access clusters to prevent reading sensitive resource types. The official plugin documentation provides a recommended ClusterRole that avoids granting access to sensitive resources.