Skip to content
OpenAdvisories

Vendor

backstage

73 known vulnerabilities.

Products

backstage 69 plugin-scaffolder-backend 10 plugin-techdocs-node 8 plugin-catalog-backend 3 backend-defaults 3 plugin-kubernetes-backend 3 plugin-auth-backend 2 plugin-techdocs-backend 2 plugin-scaffolder-backend-module-confluence-to-markdown 2 plugin-proxy-backend 2 plugin-scaffolder-backend-module-bitbucket-cloud 2 plugin-scaffolder-backend-module-bitbucket-server 2 plugin-catalog-backend-module-azure 1 plugin-catalog-backend-module-aws 1 plugin-auth-backend-module-cloudflare-access-provider 1 plugin-catalog-backend-module-unprocessed 1 plugin-catalog-unprocessed-entities 1 plugin-catalog-unprocessed-entities-common 1 plugin-search-backend 1 plugin-search-backend-module-elasticsearch 1 plugin-auth-node 1 plugin-catalog-backend-module-bitbucket-server 1 plugin-scaffolder-backend-module-sentry 1 plugin-catalog-backend-module-gitlab 1 plugin-scaffolder-backend-module-azure 1 plugin-scaffolder-backend-module-github 1 plugin-scaffolder-backend-module-gitlab 1 plugin-auth-backend-module-oidc-provider 1
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Low 3.1
    CVE-2026-106496

    Backstage: Inconsistent enforcement of allowed location types during catalog processing

    Backstage is an open framework for building developer portals. Prior to 3.9.1, the @backstage/plugin-catalog-backend package is affected by inconsistent enforcement of allowed location types during catalog processing. Under certain configurations, the catalog…

    backstage backstage plugin-catalog-backend @backstage/plugin-catalog-backend npm
  • Low 3.0
    CVE-2026-106493

    Backstage: Cloud storage catalog locations may cross configured storage boundaries

    Backstage is an open framework for building developer portals. Prior to 1.54.6, cloud storage catalog providers did not sufficiently validate object paths. A principal able to create or rename objects in a configured Azure Blob Storage or AWS S3 catalog sourc…

    backstage backstage plugin-catalog-backend-module-aws plugin-catalog-backend-module-azure npm
  • Low 3.5
    CVE-2026-106487

    Backstage: Unsupported catalog cluster authentication mode in kubernetes backend

    Backstage is an open framework for building developer portals. Prior to 0.21.10, the @backstage/plugin-kubernetes-backend package is affected by unsupported catalog cluster authentication mode in kubernetes backend. Deployments using catalog cluster discovery…

    backstage backstage plugin-kubernetes-backend @backstage/plugin-kubernetes-backend npm
  • Low 1.7
    CVE-2026-32236

    @backstage/plugin-auth-backend: SSRF in experimental CIMD metadata fetch

    Backstage is an open framework for building developer portals. Prior to 0.27.1, a Server-Side Request Forgery (SSRF) vulnerability exists in @backstage/plugin-auth-backend when auth.experimentalClientIdMetadataDocuments.enabled is set to true. The CIMD metada…

    backstage plugin-auth-backend @backstage/plugin-auth-backend npm
  • Low 2.0
    CVE-2026-29184

    @backstage/plugin-scaffolder-backend: Potential Session Token Exfiltration via Log Redaction Bypass

    Backstage is an open framework for building developer portals. Prior to version 3.1.4, a malicious scaffolder template can bypass the log redaction mechanism to exfiltrate secrets provided run through task event logs. This issue has been patched in version 3.…

    backstage backstage @backstage/plugin-scaffolder-backend npm
  • Low 2.7
    CVE-2026-29185

    @backstage/integration: Potential reading of SCM URLs using built in token

    Backstage is an open framework for building developer portals. Prior to version 1.20.1, a vulnerability in the SCM URL parsing used by Backstage integrations allowed path traversal sequences in encoded form to be included in file paths. When these URLs were p…

    backstage backstage @backstage/integration npm
  • Low 3.5
    CVE-2026-24048

    Backstage has a Possible SSRF when reading from allowed URL's in `backend.reading.allow`

    Backstage is an open framework for building developer portals, and @backstage/backend-defaults provides the default implementations and setup for a standard Backstage backend app. Prior to versions 0.12.2, 0.13.2, 0.14.1, and 0.15.0, the `FetchUrlReader` comp…

    backstage backstage @backstage/backend-defaults npm
  • Low 2.6
    CVE-2025-55285

    @backstage/plugin-scaffolder-backend Template Secret Leakage in Logs in Scaffolder When Using `fetch:template`

    @backstage/plugin-scaffolder-backend is the backend for the default Backstage software templates. Prior to version 2.1.1, duplicate logging of the input values in the fetch:template action in the Scaffolder meant that some of the secrets were not properly red…

    backstage backstage @backstage/plugin-scaffolder-backend npm