Skip to content
OpenAdvisories

Package · npm

@backstage/backend-defaults

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

6 results · Feed

  • Medium 4.3
    CVE-2026-106495

    Backstage: Improper access control in backend action invocation

    Backstage is an open framework for building developer portals. Prior to 0.17.8, the @backstage/backend-defaults package is affected by improper access control in backend action invocation. An authenticated user could invoke actions that an operator had exclud…

    backstage backstage backend-defaults @backstage/backend-defaults npm
  • Medium 4.4
    CVE-2026-106494

    Backstage: Improper input validation in cloud storage URL readers

    Backstage is an open framework for building developer portals. Prior to 0.17.8, the @backstage/backend-defaults package is affected by improper input validation in cloud storage url readers. An attacker with write access to a cloud storage bucket used by Back…

    backstage backstage backend-defaults @backstage/backend-defaults npm
  • Low 3.0
    CVE-2026-106493

    Backstage: Cloud storage catalog locations may cross configured storage boundaries

    Backstage is an open framework for building developer portals. Prior to 1.54.6, cloud storage catalog providers did not sufficiently validate object paths. A principal able to create or rename objects in a configured Azure Blob Storage or AWS S3 catalog sourc…

    backstage backstage plugin-catalog-backend-module-aws plugin-catalog-backend-module-azure npm
  • High 7.6
    CVE-2026-106492

    Backstage: Improper preservation of access restrictions during service credential delegation

    Backstage is an open framework for building developer portals. Prior to 0.16.1 and 0.17.8, the @backstage/backend-defaults package is affected by improper preservation of access restrictions during service credential delegation. An external service credential…

    backstage backstage backend-defaults @backstage/backend-defaults npm
  • Low 3.5
    CVE-2026-24048

    Backstage has a Possible SSRF when reading from allowed URL's in `backend.reading.allow`

    Backstage is an open framework for building developer portals, and @backstage/backend-defaults provides the default implementations and setup for a standard Backstage backend app. Prior to versions 0.12.2, 0.13.2, 0.14.1, and 0.15.0, the `FetchUrlReader` comp…

    backstage backstage @backstage/backend-defaults npm
  • High 7.1
    CVE-2026-24046 Public exploit

    Backstage has a Possible Symlink Path Traversal in Scaffolder Actions

    Backstage is an open framework for building developer portals. Multiple Scaffolder actions and archive extraction utilities were vulnerable to symlink-based path traversal attacks. An attacker with access to create and execute Scaffolder templates could explo…

    backstage backstage @backstage/plugin-scaffolder-backend @backstage/backend-defaults npm