Backstage vulnerabilities
73 CVEs and advisories name Backstage as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-115923Backstage catalog rules can be bypassed for URL locations using encoded path segments
- CVE-2026-106495Backstage: Improper access control in backend action invocation
- CVE-2026-106557Backstage: Improper input validation in TechDocs Markdown extension configuration
- CVE-2026-106563Backstage: Improper entity validation in deprecated Kubernetes services endpoint
- CVE-2026-106562Backstage: Incorrect authorization in search engine permission filtering
- CVE-2026-106561Backstage: Sensitive information disclosure in Kubernetes resource queries
- CVE-2026-106560Backstage: Improper repository path validation in a Scaffolder backend module
- CVE-2026-106559Backstage: Improper input validation in Confluence to Markdown scaffolder module
- CVE-2026-106558Backstage: Improper validation of TechDocs MkDocs configuration
- CVE-2026-106556Backstage: Configuration bypass in TechDocs mkdocs.yml sanitization
- CVE-2026-106510Backstage: Remote code execution via crafted markdown_extensions in TechDocs mkdocs.yml
- CVE-2026-106509Backstage: Improper validation of MkDocs theme configuration in TechDocs
- CVE-2026-106508Backstage: Potential file exposure through local TechDocs publisher
- CVE-2026-106507Backstage: TechDocs arbitrary file read via mkdocs snippets
- CVE-2026-106506Backstage: Improper input validation in scaffolder task list ordering
- CVE-2026-106505Backstage: Bypass of MkDocs configuration sanitizer in TechDocs backend
- CVE-2026-106504Backstage: Sensitive information exposure in scaffolder task logs
- CVE-2026-106503Backstage: Scaffolder action input authorization bypass
- CVE-2026-106502Backstage: Sensitive information may be exposed in Scaffolder task failure events
- CVE-2026-106501Backstage: Sensitive information exposure in Scaffolder
- CVE-2026-106500Backstage: Improper task state validation in Scaffolder backend
- CVE-2026-106499Backstage: Secret-derived values may be exposed in scaffolder task logs
- CVE-2026-106498Backstage: Improper URL validation in catalog entity placeholder resolution
- CVE-2026-106497Backstage: Inconsistent catalog property permission evaluation
- CVE-2026-106496Backstage: Inconsistent enforcement of allowed location types during catalog processing
- CVE-2026-106494Backstage: Improper input validation in cloud storage URL readers
- CVE-2026-106493Backstage: Cloud storage catalog locations may cross configured storage boundaries
- CVE-2026-106492Backstage: Improper preservation of access restrictions during service credential delegation
- CVE-2026-106491Backstage: Improper input validation in proxy-backend
- CVE-2026-106490Backstage: Improper input validation in TechDocs static content requests