BA
Product
backstage
60
CVEs
0
On KEV
9.9
Max CVSS
43
New 30D
Severity mix
Critical 3High 16Medium 38Low 3
Watch
Add backstage to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-106486 | 9.9 | Oct 6 | Backstage: Improper filesystem validation in Bitbucket pull-request scaffolder actions Affected: < 1.54.6 |
| CVE-2026-29186 | 9.8 | Mar 7 | @backstage/plugin-techdocs-node: TechDocs Mkdocs Configuration Key Enables Arbitrary Code Execution Affected: < 1.14.3 |
| CVE-2026-106501 | 9.6 | Oct 6 | Backstage: Sensitive information exposure in Scaffolder Affected: < 1.49.6; >= 1.50.0-next.0, < 1.50.5; >= 1.51.0-next.0, < 1.54.6 |
| CVE-2026-106558 | 8.8 | Oct 7 | Backstage: Improper validation of TechDocs MkDocs configuration Affected: < 1.50.7; >= 1.51.0-next.0, < 1.54.9; >= 1.55.0-next.0, < 1.55.2 |
| CVE-2026-106509 | 8.8 | Oct 6 | Backstage: Improper validation of MkDocs theme configuration in TechDocs Affected: < 1.50.5; >= 1.51.0-next.0, < 1.54.6 |
| CVE-2026-88064 | 8.8 | Sep 16 | Backstage: Improper input validation in TechDocs MkDocs configuration Affected: < 1.14.6; >= 1.15.0, < 1.15.4 |
| CVE-2026-25153 | 8.8 | Jan 30 | @backstage/plugin-techdocs-node vulnerable to arbitrary code execution via MkDocs hooks Affected: < 1.13.11; = 1.14.0 |
| CVE-2026-106505 | 8.5 | Oct 6 | Backstage: Bypass of MkDocs configuration sanitizer in TechDocs backend Affected: < 1.50.5; >= 1.51.0-next.0, < 1.54.6 |
| CVE-2026-106500 | 8.5 | Oct 6 | Backstage: Improper task state validation in Scaffolder backend Affected: < 1.49.6; >= 1.50.0-next.0, < 1.50.5; >= 1.51.0-next.0, < 1.54.6 |
| CVE-2026-106459 | 8.5 | Oct 6 | Backstage: Improper input validation in Sentry scaffolder actions Affected: >= 1.47.0, < 1.54.8 |
| CVE-2026-106503 | 8.1 | Oct 6 | Backstage: Scaffolder action input authorization bypass Affected: < 1.49.6; >= 1.50.0-next.0, < 1.50.5; >= 1.51.0-next.0, < 1.54.6 |
| CVE-2026-106488 | 8.1 | Oct 6 | Backstage: Improper authentication in the OIDC provider Affected: < 1.54.6 |
| CVE-2026-106457 | 8.1 | Oct 6 | Backstage: Insufficient audience validation in the Cloudflare Access auth provider Affected: >= 1.26.0, < 1.55.0 |
| CVE-2026-106557 | 7.7 | Oct 7 | Backstage: Improper input validation in TechDocs Markdown extension configuration Affected: < 1.50.5; >= 1.51.0-next.0, < 1.54.6 |
| CVE-2026-106556 | 7.7 | Oct 7 | Backstage: Configuration bypass in TechDocs mkdocs.yml sanitization Affected: < 1.50.5; >= 1.51.0-next.0, < 1.54.6 |
| CVE-2026-106510 | 7.7 | Oct 7 | Backstage: Remote code execution via crafted markdown_extensions in TechDocs mkdocs.yml Affected: < 1.50.5; >= 1.51.0-next.0, < 1.54.6 |
| CVE-2026-106498 | 7.7 | Oct 6 | Backstage: Improper URL validation in catalog entity placeholder resolution Affected: < 1.49.6; >= 1.50.0-next.0, < 1.50.5; >= 1.51.0-next.0, < 1.51.3; >= 1.52.0-next.0, < 1.53.2; >= 1.54.0-next.0, < 1.54.6 |
| CVE-2026-106455 | 7.7 | Oct 6 | Backstage: Improper validation of MkDocs plugin configuration in TechDocs Affected: >= 0.71.1, < 1.50.6; >= 1.51.0-next.0, < 1.54.8 |
| CVE-2026-24046 | 7.1 | Jan 21 | Backstage has a Possible Symlink Path Traversal in Scaffolder Actions Affected: @backstage/backend-defaults < 0.12.2; @backstage/backend-defaults >= 0.13.0, < 0.13.2; @backstage/backend-defaults >= 0.14.0, < 0.14.1; @backstage/plugin-scaffolder-backend < 2.2.2; @backstage/plugin-scaffolder-backend >= 3.0.0, < 3.0.2; @backstage/plugin-scaffolder-backend >= 3.1.0, < 3.1.1; +2 more |
| CVE-2026-106460 | 6.8 | Oct 6 | Backstage: Explicit negative email verification can be ignored during shared OAuth profile normalization Affected: >= 1.18.0, < 1.49.7; >= 1.50.0-next.0, < 1.54.7 |
| CVE-2026-115923 New | 6.5 | Oct 26 | Backstage catalog rules can be bypassed for URL locations using encoded path segments Affected: < 3.9.2; >= 4.0.0, < 4.0.2 |
| CVE-2026-106563 | 6.5 | Oct 7 | Backstage: Improper entity validation in deprecated Kubernetes services endpoint Affected: < 1.54.1 |
| CVE-2026-106560 | 6.5 | Oct 7 | Backstage: Improper repository path validation in a Scaffolder backend module Affected: < 1.54.6 |
| CVE-2026-106559 | 6.5 | Oct 7 | Backstage: Improper input validation in Confluence to Markdown scaffolder module Affected: < 1.54.6 |
| CVE-2026-106508 | 6.5 | Oct 6 | Backstage: Potential file exposure through local TechDocs publisher Affected: < 1.54.6 |
| CVE-2026-106507 | 6.5 | Oct 6 | Backstage: TechDocs arbitrary file read via mkdocs snippets Affected: < 1.54.6 |
| CVE-2026-106504 | 6.5 | Oct 6 | Backstage: Sensitive information exposure in scaffolder task logs Affected: < 1.54.6 |
| CVE-2026-106496 | 6.5 | Oct 6 | Backstage: Inconsistent enforcement of allowed location types during catalog processing Affected: < 1.54.6 |
| CVE-2026-106492 | 6.5 | Oct 6 | Backstage: Improper preservation of access restrictions during service credential delegation Affected: < 1.49.6; >= 1.50.0-next.0, < 1.54.6 |
| CVE-2026-106490 | 6.5 | Oct 6 | Backstage: Improper input validation in TechDocs static content requests Affected: < 1.54.6 |
| CVE-2026-106489 | 6.5 | Oct 6 | Backstage: Improper authorization enforcement for TechDocs static content Affected: < 1.54.6 |
| CVE-2026-106458 | 6.5 | Oct 6 | Backstage: Inconsistent repository filtering in Bitbucket Server catalog event updates Affected: >= 1.38.0, < 1.55.0 |
| CVE-2026-106456 | 6.5 | Oct 6 | Backstage: Inconsistent credential enforcement for overlapping proxy routes Affected: >= 1.28.0, < 1.55.0 |
| CVE-2026-29184 | 6.5 | Mar 7 | @backstage/plugin-scaffolder-backend: Potential Session Token Exfiltration via Log Redaction Bypass Affected: < 3.1.4 |
| CVE-2026-25152 | 6.5 | Jan 30 | @backstage/plugin-techdocs-node vulnerable to possible Path Traversal in TechDocs Local Generator Affected: < 1.13.11; = 1.14.0 |
| CVE-2024-45815 | 6.5 | Sep 17 | Prototype pollution in @backstage/plugin-catalog-backend Affected: < 1.26.0 |
| CVE-2024-45816 | 6.5 | Sep 17 | Storage bucket Directory Traversal in @backstage/plugin-techdocs-backend Affected: < 1.10.13 |
| CVE-2026-106491 | 6.4 | Oct 6 | Backstage: Improper input validation in proxy-backend Affected: < 1.54.6 |
| CVE-2026-106462 | 6.4 | Oct 6 | Backstage: Scaffolder credential handling may allow unintended GitHub authentication fallback Affected: < 1.54.6 |
| CVE-2026-24047 | 6.3 | Jan 21 | @backstage/cli-common has a possible `resolveSafeChildPath` Symlink Chain Bypass Affected: < 0.1.17 |
| CVE-2026-73563 | 6.1 | Aug 13 | Backstage: Unauthenticated OAuth account takeover via `redirect_uri` allowlist bypass in `@backstage/plugin-auth-backend` Affected: < 0.29.2 |
| CVE-2024-47762 | 5.8 | Oct 3 | Unexpected visibility of environment variable configurations in @backstage/plugin-app-backend Affected: < 0.3.75 |
| CVE-2026-106463 | 5.4 | Oct 6 | Backstage: Improper authorization in GitLab organizational user ingestion Affected: < 1.54.6 |
| CVE-2024-53983 | 5.4 | Nov 29 | Server-side request forgery in Backstage Scaffolder plugin Affected: < 0.4.12; = 0.5.0; = 0.6.0 |
| CVE-2024-46976 | 5.4 | Sep 17 | Circumvention of cross site scripting Protection in @backstage/plugin-techdocs-backend Affected: < 1.10.13 |
| CVE-2026-106506 | 5.3 | Oct 6 | Backstage: Improper input validation in scaffolder task list ordering Affected: < 1.54.6 |
| CVE-2026-106502 | 5.3 | Oct 6 | Backstage: Sensitive information may be exposed in Scaffolder task failure events Affected: < 1.54.6 |
| CVE-2026-106561 | 5.0 | Oct 7 | Backstage: Sensitive information disclosure in Kubernetes resource queries Affected: < 1.54.2 |
| CVE-2026-106487 | 5.0 | Oct 6 | Backstage: Unsupported catalog cluster authentication mode in kubernetes backend Affected: < 1.54.6 |
| CVE-2026-106499 | 4.9 | Oct 6 | Backstage: Secret-derived values may be exposed in scaffolder task logs Affected: < 1.54.6 |