Plugin kubernetes backend: Backstage: Unsupported catalog cluster authentication mode in kubernetes backend (CVE-2026-106487)

The vulnerability (CVE-2026-106487) affects @backstage/plugin-kubernetes-backend versions before 0.21.10. When catalog contributors have permissions to create or modify kubernetes-cluster Resource entities, and with appropriate endpoint permissions and pod RBAC, the backend may use its local in-cluster identity to access Kubernetes resources readable by that identity. The credential usage is limited to the local in-cluster API endpoint and is not sent to catalog-supplied endpoints. This could lead to unintended exposure of Kubernetes resources.

The impact is limited to potential exposure of Kubernetes resources accessible by the backend's local in-cluster identity. The CVSS score is 3.5 (low severity), indicating limited confidentiality impact with no integrity or availability impact. The vulnerability requires network access and low privileges with high attack complexity.

A patch is available in @backstage/plugin-kubernetes-backend version 0.21.10. Users should upgrade to this version to remediate the issue. Workarounds include avoiding service account authentication through catalog-provided clusters and instead using the supported static configuration method. Additionally, restrict catalog ingestion to prevent untrusted users from creating or modifying Kubernetes cluster Resource entities.