# cve.now: Backstage

The newest entries naming Backstage as an affected vendor (up to 200), of 73 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-115923](https://cve.now/CVE-2026-115923.md): Backstage catalog rules can be bypassed for URL locations using encoded path segments (CVSS 6.5)
- [CVE-2026-106495](https://cve.now/CVE-2026-106495.md): Backstage: Improper access control in backend action invocation (CVSS 4.3)
- [CVE-2026-106557](https://cve.now/CVE-2026-106557.md): Backstage: Improper input validation in TechDocs Markdown extension configuration (CVSS 7.7)
- [CVE-2026-106563](https://cve.now/CVE-2026-106563.md): Backstage: Improper entity validation in deprecated Kubernetes services endpoint (CVSS 5.3)
- [CVE-2026-106562](https://cve.now/CVE-2026-106562.md): Backstage: Incorrect authorization in search engine permission filtering (CVSS 4.3)
- [CVE-2026-106561](https://cve.now/CVE-2026-106561.md): Backstage: Sensitive information disclosure in Kubernetes resource queries (CVSS 5.0)
- [CVE-2026-106560](https://cve.now/CVE-2026-106560.md): Backstage: Improper repository path validation in a Scaffolder backend module (CVSS 7.1)
- [CVE-2026-106559](https://cve.now/CVE-2026-106559.md): Backstage: Improper input validation in Confluence to Markdown scaffolder module (CVSS 6.3)
- [CVE-2026-106558](https://cve.now/CVE-2026-106558.md): Backstage: Improper validation of TechDocs MkDocs configuration (CVSS 8.8)
- [CVE-2026-106556](https://cve.now/CVE-2026-106556.md): Backstage: Configuration bypass in TechDocs mkdocs.yml sanitization (CVSS 7.7)
- [CVE-2026-106510](https://cve.now/CVE-2026-106510.md): Backstage: Remote code execution via crafted markdown\_extensions in TechDocs mkdocs.yml (CVSS 7.7)
- [CVE-2026-106509](https://cve.now/CVE-2026-106509.md): Backstage: Improper validation of MkDocs theme configuration in TechDocs (CVSS 7.7)
- [CVE-2026-106508](https://cve.now/CVE-2026-106508.md): Backstage: Potential file exposure through local TechDocs publisher (CVSS 5.3)
- [CVE-2026-106507](https://cve.now/CVE-2026-106507.md): Backstage: TechDocs arbitrary file read via mkdocs snippets (CVSS 5.3)
- [CVE-2026-106506](https://cve.now/CVE-2026-106506.md): Backstage: Improper input validation in scaffolder task list ordering (CVSS 5.3)
- [CVE-2026-106505](https://cve.now/CVE-2026-106505.md): Backstage: Bypass of MkDocs configuration sanitizer in TechDocs backend (CVSS 7.7)
- [CVE-2026-106504](https://cve.now/CVE-2026-106504.md): Backstage: Sensitive information exposure in scaffolder task logs (CVSS 6.5)
- [CVE-2026-106503](https://cve.now/CVE-2026-106503.md): Backstage: Scaffolder action input authorization bypass (CVSS 8.1)
- [CVE-2026-106502](https://cve.now/CVE-2026-106502.md): Backstage: Sensitive information may be exposed in Scaffolder task failure events (CVSS 5.3)
- [CVE-2026-106501](https://cve.now/CVE-2026-106501.md): Backstage: Sensitive information exposure in Scaffolder (CVSS 9.6)
- [CVE-2026-106500](https://cve.now/CVE-2026-106500.md): Backstage: Improper task state validation in Scaffolder backend (CVSS 8.5)
- [CVE-2026-106499](https://cve.now/CVE-2026-106499.md): Backstage: Secret-derived values may be exposed in scaffolder task logs (CVSS 4.9)
- [CVE-2026-106498](https://cve.now/CVE-2026-106498.md): Backstage: Improper URL validation in catalog entity placeholder resolution (CVSS 7.7)
- [CVE-2026-106497](https://cve.now/CVE-2026-106497.md): Backstage: Inconsistent catalog property permission evaluation (CVSS 4.3)
- [CVE-2026-106496](https://cve.now/CVE-2026-106496.md): Backstage: Inconsistent enforcement of allowed location types during catalog processing (CVSS 3.1)
- [CVE-2026-106494](https://cve.now/CVE-2026-106494.md): Backstage: Improper input validation in cloud storage URL readers (CVSS 4.4)
- [CVE-2026-106493](https://cve.now/CVE-2026-106493.md): Backstage: Cloud storage catalog locations may cross configured storage boundaries (CVSS 3.0)
- [CVE-2026-106492](https://cve.now/CVE-2026-106492.md): Backstage: Improper preservation of access restrictions during service credential delegation (CVSS 7.6)
- [CVE-2026-106491](https://cve.now/CVE-2026-106491.md): Backstage: Improper input validation in proxy-backend (CVSS 6.4)
- [CVE-2026-106490](https://cve.now/CVE-2026-106490.md): Backstage: Improper input validation in TechDocs static content requests (CVSS 6.5)
- [CVE-2026-106489](https://cve.now/CVE-2026-106489.md): Backstage: Improper authorization enforcement for TechDocs static content (CVSS 6.5)
- [CVE-2026-106488](https://cve.now/CVE-2026-106488.md): Backstage: Improper authentication in the OIDC provider (CVSS 8.1)
- [CVE-2026-106487](https://cve.now/CVE-2026-106487.md): Backstage: Unsupported catalog cluster authentication mode in kubernetes backend (CVSS 3.5)
- [CVE-2026-106486](https://cve.now/CVE-2026-106486.md): Backstage: Improper filesystem validation in Bitbucket pull-request scaffolder actions (CVSS 8.5)
- [CVE-2026-106463](https://cve.now/CVE-2026-106463.md): Backstage: Improper authorization in GitLab organizational user ingestion (CVSS 5.4)
- [CVE-2026-106462](https://cve.now/CVE-2026-106462.md): Backstage: Scaffolder credential handling may allow unintended GitHub authentication fallback (CVSS 6.4)
- [CVE-2026-106461](https://cve.now/CVE-2026-106461.md): Backstage: Incorrect authorization in scaffolder task listing (CVSS 4.3)
- [CVE-2026-106460](https://cve.now/CVE-2026-106460.md): Backstage: Explicit negative email verification can be ignored during shared OAuth profile normalization (CVSS 6.8)
- [CVE-2026-106459](https://cve.now/CVE-2026-106459.md): Backstage: Improper input validation in Sentry scaffolder actions (CVSS 8.5)
- [CVE-2026-106458](https://cve.now/CVE-2026-106458.md): Backstage: Inconsistent repository filtering in Bitbucket Server catalog event updates (CVSS 6.5)
- [CVE-2026-106457](https://cve.now/CVE-2026-106457.md): Backstage: Insufficient audience validation in the Cloudflare Access auth provider (CVSS 6.8)
- [CVE-2026-106456](https://cve.now/CVE-2026-106456.md): Backstage: Inconsistent credential enforcement for overlapping proxy routes (CVSS 4.8)
- [CVE-2026-106455](https://cve.now/CVE-2026-106455.md): Backstage: Improper validation of MkDocs plugin configuration in TechDocs (CVSS 7.7)
- [CVE-2026-88064](https://cve.now/CVE-2026-88064.md): Backstage: Improper input validation in TechDocs MkDocs configuration (CVSS 8.8)
- [CVE-2026-73563](https://cve.now/CVE-2026-73563.md): Backstage: Unauthenticated OAuth account takeover via \`redirect\_uri\` allowlist bypass in \`@backstage/plugin-auth-backend\` (CVSS 4.7)
- [CVE-2026-44374](https://cve.now/CVE-2026-44374.md): Backstage: Catalog unprocessed read endpoints allow authenticated cross-owner data access without permission checks (CVSS 4.3)
- [CVE-2026-32237](https://cve.now/CVE-2026-32237.md): @backstage/plugin-scaffolder-backend: Possible exposure of defaultEnvironment secrets using dry-run endpoint (CVSS 4.4)
- [CVE-2026-32236](https://cve.now/CVE-2026-32236.md): @backstage/plugin-auth-backend: SSRF in experimental CIMD metadata fetch (CVSS 1.7)
- [CVE-2026-32235](https://cve.now/CVE-2026-32235.md): @backstage/plugin-auth-backend: OAuth redirect URI allowlist bypass (CVSS 5.9)
- [CVE-2026-29186](https://cve.now/CVE-2026-29186.md): @backstage/plugin-techdocs-node: TechDocs Mkdocs Configuration Key Enables Arbitrary Code Execution (CVSS 7.7)
- [CVE-2026-29184](https://cve.now/CVE-2026-29184.md): @backstage/plugin-scaffolder-backend: Potential Session Token Exfiltration via Log Redaction Bypass (CVSS 2.0)
- [CVE-2026-29185](https://cve.now/CVE-2026-29185.md): @backstage/integration: Potential reading of SCM URLs using built in token (CVSS 2.7)
- [CVE-2026-25152](https://cve.now/CVE-2026-25152.md): @backstage/plugin-techdocs-node vulnerable to possible Path Traversal in TechDocs Local Generator (CVSS 5.3)
- [CVE-2026-25153](https://cve.now/CVE-2026-25153.md): @backstage/plugin-techdocs-node vulnerable to arbitrary code execution via MkDocs hooks (CVSS 7.7)
- [CVE-2026-24048](https://cve.now/CVE-2026-24048.md): Backstage has a Possible SSRF when reading from allowed URL's in \`backend.reading.allow\` (CVSS 3.5)
- [CVE-2026-24047](https://cve.now/CVE-2026-24047.md): @backstage/cli-common has a possible \`resolveSafeChildPath\` Symlink Chain Bypass (CVSS 6.3)
- [CVE-2026-24046](https://cve.now/CVE-2026-24046.md): Backstage has a Possible Symlink Path Traversal in Scaffolder Actions (CVSS 7.1)
- [CVE-2025-55285](https://cve.now/CVE-2025-55285.md): @backstage/plugin-scaffolder-backend Template Secret Leakage in Logs in Scaffolder When Using \`fetch:template\` (CVSS 2.6)
- [CVE-2025-32791](https://cve.now/CVE-2025-32791.md): Permission policy information leakage in Backstage permission system (CVSS 4.3)
- [CVE-2024-53983](https://cve.now/CVE-2024-53983.md): Server-side request forgery in Backstage Scaffolder plugin (CVSS 5.4)
- [CVE-2024-47762](https://cve.now/CVE-2024-47762.md): Unexpected visibility of environment variable configurations in @backstage/plugin-app-backend (CVSS 5.8)
- [CVE-2024-45815](https://cve.now/CVE-2024-45815.md): Prototype pollution in @backstage/plugin-catalog-backend (CVSS 6.5)
- [CVE-2024-45816](https://cve.now/CVE-2024-45816.md): Storage bucket Directory Traversal in @backstage/plugin-techdocs-backend (CVSS 6.5)
- [CVE-2024-46976](https://cve.now/CVE-2024-46976.md): Circumvention of cross site scripting Protection in @backstage/plugin-techdocs-backend (CVSS 6.5)
- [CVE-2024-26150](https://cve.now/CVE-2024-26150.md): \`@backstage/backend-common\` vulnerable to path traversal through symlinks (CVSS 8.7)
- [CVE-2023-35926](https://cve.now/CVE-2023-35926.md): Insecure sandbox in Backstage Scaffolder plugin (CVSS 8.1)
- [CVE-2023-25571](https://cve.now/CVE-2023-25571.md): Backstage has XSS Vulnerability in Software Catalog (CVSS 6.8)
- [CVE-2021-43783](https://cve.now/CVE-2021-43783.md): Path Traversal in @backstage/plugin-scaffolder-backend (CVSS 8.5)
- [CVE-2021-43776](https://cve.now/CVE-2021-43776.md): XSS vulnerability in @backstage/plugin-auth-backend (CVSS 7.4)
- [CVE-2021-41151](https://cve.now/CVE-2021-41151.md): Path Traversal in @backstage/plugin-scaffolder-backend (CVSS 6.8)
- [CVE-2021-32662](https://cve.now/CVE-2021-32662.md): TechDocs mkdocs.yml path traversal (CVSS 6.5)
- [CVE-2021-32661](https://cve.now/CVE-2021-32661.md): TechDocs object element script injection (CVSS 6.8)
- [CVE-2021-32660](https://cve.now/CVE-2021-32660.md): TechDocs content sanitization bypass (CVSS 6.8)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/backstage
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.