Riskcovery

CVE-2026-106498

Backstage: Improper URL validation in catalog entity placeholder resolution

State
Published
Severity
7.7 High
Published
Oct 6, 2026
Updated
Oct 9, 2026
Reserved
Oct 6, 2026

Read the record on cve.org

Description

Backstage is an open framework for building developer portals. Prior to 3.5.1, 3.6.2, 3.7.2, 3.8.2 and 3.9.1, the @backstage/plugin-catalog-backend package is affected by improper url validation in catalog entity placeholder resolution. An authenticated Backstage user could craft a catalog entity with placeholder directives that reference resources outside the entity's source repository. Under certain configurations, this could allow access to data not intended to be available to the user. This issue is fixed in versions 3.5.1, 3.6.2, 3.7.2, 3.8.2 and 3.9.1.

Scores

CVSSScoreVectorSource
3.17.7 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:NGitHub_M

Weaknesses

  • CWE-863 Incorrect Authorization
  • CWE-918 Server-Side Request Forgery (SSRF)

Affected Products

ProductVersions
backstagebackstage
  • < 1.49.6Affected
  • >= 1.50.0-next.0, < 1.50.5Affected
  • >= 1.51.0-next.0, < 1.51.3Affected
  • >= 1.52.0-next.0, < 1.53.2Affected
  • >= 1.54.0-next.0, < 1.54.6Affected
plugin-catalog-backend@backstage
  • < 3.5.1Affected
  • >= 3.6.0, < 3.6.2Affected
  • >= 3.7.0, < 3.7.2Affected
  • >= 3.8.0, < 3.8.2Affected
  • >= 3.9.0, < 3.9.1Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.