Skip to content
OpenAdvisories

Package · npm

@backstage/backend-defaults

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.6
    CVE-2026-106492

    Backstage: Improper preservation of access restrictions during service credential delegation

    Backstage is an open framework for building developer portals. Prior to 0.16.1 and 0.17.8, the @backstage/backend-defaults package is affected by improper preservation of access restrictions during service credential delegation. An external service credential…

    backstage backstage backend-defaults @backstage/backend-defaults npm
  • High 7.1
    CVE-2026-24046 Public exploit

    Backstage has a Possible Symlink Path Traversal in Scaffolder Actions

    Backstage is an open framework for building developer portals. Multiple Scaffolder actions and archive extraction utilities were vulnerable to symlink-based path traversal attacks. An attacker with access to create and execute Scaffolder templates could explo…

    backstage backstage @backstage/plugin-scaffolder-backend @backstage/backend-defaults npm