A vulnerability in the @backstage/plugin-catalog-backend-module-gitlab prior to version 0.8.7 allows improper authorization during GitLab organizational user ingestion. This can result in an unintended catalog identity being admitted, potentially granting unauthorized access with the permissions of a standard authenticated user. The issue affects deployments that enable GitLab organization event ingestion and use scoped catalog users as an access boundary. A fix is available in version 0.8.7.
CVE-2026-106486 is a high-severity vulnerability in the Backstage plugin scaffolder backend modules for Bitbucket Cloud and Bitbucket Server. It allows an authenticated user with limited privileges to influence filesystem paths outside the intended working directory when executing certain templates. This can lead to compromise of backend confidentiality, integrity, or availability depending on deployment specifics. Fixed versions are 0.3.10 for the Bitbucket Cloud module and 0.2.25 for the Bitbucket Server module.
A vulnerability in the @backstage/plugin-kubernetes-backend prior to version 0.21.10 allows deployments using catalog cluster discovery to potentially expose Kubernetes resources. This occurs when catalog contributors can create or modify kubernetes-cluster Resource entities, enabling the backend to use its local in-cluster identity with the local API endpoint. The issue is patched in version 0.21.10.
A vulnerability in the @backstage/plugin-auth-backend-module-oidc-provider prior to version 0.4.20 allows an authenticated user to impersonate another catalog identity if the OIDC provider permits unverified email addresses. This can lead to unauthorized access and permission escalation. There is no demonstrated impact on availability. A patch is available in version 0.4.20. Workarounds include disabling email-based sign-in resolution or requiring email verification by the identity provider.
An authorization flaw in the Backstage TechDocs backend plugin allows an authenticated user with access to one documentation site to access documentation belonging to other entities. This issue only affects deployments using the external TechDocs builder with external storage providers (such as S3 or GCS) and the permission framework enabled. Deployments without the permission framework or those serving TechDocs from local storage are not affected. The vulnerability is patched in version 2.2.4 of the @backstage/plugin-techdocs-backend package.
An improper input validation vulnerability in the Backstage TechDocs backend plugin allows authenticated users to read restricted TechDocs content when using the Azure Blob Storage provider with entity-level permissions enabled. Deployments that disable the default backend authentication policy may have broader exposure. The issue is patched in version 2.2.4 of the plugin.
A path traversal vulnerability exists in the Backstage plugin catalog backend modules for Azure Blob Storage and AWS S3. Insufficient validation of storage object paths allows catalog descriptors to be read from outside the intended storage boundaries, limited to locations accessible by the backend's configured credentials. This issue affects versions prior to 0.3.21 for the Azure module, 0.4.27 for the AWS module, and 0.7.18 for the backend defaults. The vulnerability has a low severity with a CVSS score of 3.0. Patches are available, and recommended mitigations include restricting blob/object creation or renaming to trusted principals, scoping credentials and network access, or disabling affected catalog providers if restrictions cannot be enforced.
An authenticated user of Backstage can exploit improper input validation in the proxy-backend plugin to cause the proxy to forward requests to paths outside the intended base path on configured target servers. This vulnerability requires authentication and affects versions of @backstage/plugin-proxy-backend prior to 0.6.17. A patch is available in version 0.6.17. As a workaround, deploying a reverse proxy or WAF to normalize request paths can mitigate the issue.
CVE-2026-106492 is a vulnerability in the @backstage/backend-defaults package where access restrictions on external service credentials can be bypassed during plugin delegation. This allows a service credential configured with limited permissions (e.g., read-only) to perform unauthorized operations such as write actions on plugins it should only read. The issue is patched in version 0.17.8 of the package.
CVE-2026-106494 is a medium severity vulnerability in the @backstage/backend-defaults package where improper input validation in cloud storage URL readers allows an attacker with write access to a cloud storage bucket to craft object names that collide with protected files in the output directory, potentially leading to content injection. This issue is patched in version 0.17.8.
A vulnerability in the @backstage/plugin-catalog-backend prior to version 3.9.1 allows inconsistent enforcement of allowed location types during catalog processing. This can lead to the processing of unintended location types, potentially resulting in unintended file access on the backend host. The issue has a low severity rating and a CVSS score of 3.1. A patch is available in version 3.9.1, and no practical workarounds exist.
An authenticated user of the Backstage plugin-catalog-backend could exploit improper URL validation in catalog entity placeholder resolution to reference resources outside the intended repository. This vulnerability could allow access to data not meant to be accessible under certain configurations. The issue is patched in version 3.9.1 of the plugin.
CVE-2026-106501 is a critical vulnerability in the @backstage/plugin-scaffolder-backend that allows an authenticated user to read another user's Scaffolder task and potentially access sensitive internal execution data. This data may include credentials for external services, leading to unauthorized disclosure and changes in those services. The issue affects multiple versions prior to 4.1.0 and has been patched in version 4.1.0. Mitigations include restricting task read permissions to task owners and limiting affected workflows to trusted operators until patched.
A vulnerability in the @backstage/plugin-scaffolder-backend before version 4.1.0 allows secret-derived values configured in scaffolder.defaultEnvironment.secrets to be exposed in scaffolder task logs. This occurs if an attacker can create or modify Scaffolder templates, potentially leaking sensitive information to users with access to those logs.
An authorization bypass vulnerability exists in the Backstage plugin-scaffolder-backend that allows an authenticated user with access to certain Scaffolder templates to bypass configured action restrictions. This could lead to unauthorized access to repositories and source-control resources depending on integration credentials. The issue is patched in version 4.1.0 of the plugin. Workarounds include restricting affected actions to trusted users and using least-privilege credentials for source-control integrations.
CVE-2026-106500 is a vulnerability in the @backstage/plugin-scaffolder-backend prior to version 4.1.0. It allows an authenticated user with permission to create and access Scaffolder tasks to potentially affect files accessible to the backend under certain timing and deployment conditions. If backend application files are writable, this can compromise the confidentiality, integrity, and availability of the backend. The issue has been patched in version 4.1.0. Mitigations include restricting task creation and read permissions to trusted users, limiting template registration and actions, and running backend files as read-only outside a dedicated Scaffolder working directory.
An authorization vulnerability in the @backstage/plugin-scaffolder-backend prior to version 4.1.0 allows an authenticated internal user to view metadata for scaffolder tasks beyond their intended permission scope. The vulnerability does not expose stored task secrets and does not impact data integrity or availability. A patch is available in version 4.1.0. Workarounds include restricting access to the task-list endpoint and avoiding sensitive data in template inputs until patched.
CVE-2026-107216 is a high-severity vulnerability in the qax-os excelize Go library versions 2.8.1 through 2.11.0. It involves uncontrolled recursion caused by the ANCHORARRAY function recursively calling CalcCellValue, which creates a new calculation context on each call and bypasses cycle detection mechanisms. This leads to a fatal Go stack overflow and process abort when mutually referencing dynamic-array formulas are evaluated. No fix is currently available.
CVE-2026-107215 is a high-severity vulnerability in the qax-os excelize Go library for Microsoft Excel spreadsheets. Versions from 2.3.1 up to and including 2.11.0 improperly allocate memory based on attacker-controlled size values from OLE compound file streams without proper validation. This can lead to excessive memory allocation or negative length allocations, causing process crashes or memory exhaustion. No patch or fixed version is currently available.
CVE-2026-107214 is a high-severity vulnerability in the qax-os excelize Go library versions 2.3.1 through 2.11.0. The issue arises from insufficient validation of attacker-controlled encryption data before decryption routines are invoked, leading to uncaught exceptions and Go runtime panics. This can cause the calling process to terminate unexpectedly when processing malformed OLE compound files with valid versioned EncryptionInfo streams. No patch or fixed version is currently available.