Login Request a demo
Low severity · published Mar 7, 2026
CVE-2026-29185
@backstage/integration: Potential reading of SCM URLs using built in token
2.7
CVSS
0.4%
EPSS
No
On KEV
Description
Backstage is an open framework for building developer portals. Prior to version 1.20.1, a vulnerability in the SCM URL parsing used by Backstage integrations allowed path traversal sequences in encoded form to be included in file paths. When these URLs were processed by integration functions that construct API URLs, the traversal segments could redirect requests to unintended SCM provider API endpoints using the configured server-side integration credentials. This issue has been patched in version 1.20.1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BA
backstage · backstage
< 1.20.1 · source: vendor
BA
Backstage/integration · Linuxfoundation
before 1.20.1 · source: NVD
Affected product
BA
backstage
backstage
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-29185
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-29185
Patch
https://github.com/backstage/backstage/security/advisories/GHSA-95v5-prp4-5gv5
More from backstage
9.9
CVE-2026-106486
Backstage: Improper filesystem validation in Bitbucket pull-request scaffolder actions
9.8
CVE-2026-29186
@backstage/plugin-techdocs-node: TechDocs Mkdocs Configuration Key Enables Arbitrary Code Execution
9.6
CVE-2026-106501
Backstage: Sensitive information exposure in Scaffolder
8.8
CVE-2026-106558
Backstage: Improper validation of TechDocs MkDocs configuration
8.8
CVE-2026-106509
Backstage: Improper validation of MkDocs theme configuration in TechDocs