Backstage vulnerabilities
73 CVEs and advisories name Backstage as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-106489Backstage: Improper authorization enforcement for TechDocs static content
- CVE-2026-106488Backstage: Improper authentication in the OIDC provider
- CVE-2026-106487Backstage: Unsupported catalog cluster authentication mode in kubernetes backend
- CVE-2026-106486Backstage: Improper filesystem validation in Bitbucket pull-request scaffolder actions
- CVE-2026-106463Backstage: Improper authorization in GitLab organizational user ingestion
- CVE-2026-106462Backstage: Scaffolder credential handling may allow unintended GitHub authentication fallback
- CVE-2026-106461Backstage: Incorrect authorization in scaffolder task listing
- CVE-2026-106460Backstage: Explicit negative email verification can be ignored during shared OAuth profile normalization
- CVE-2026-106459Backstage: Improper input validation in Sentry scaffolder actions
- CVE-2026-106458Backstage: Inconsistent repository filtering in Bitbucket Server catalog event updates
- CVE-2026-106457Backstage: Insufficient audience validation in the Cloudflare Access auth provider
- CVE-2026-106456Backstage: Inconsistent credential enforcement for overlapping proxy routes
- CVE-2026-106455Backstage: Improper validation of MkDocs plugin configuration in TechDocs
- CVE-2026-88064Backstage: Improper input validation in TechDocs MkDocs configuration
- CVE-2026-73563Backstage: Unauthenticated OAuth account takeover via `redirect_uri` allowlist bypass in `@backstage/plugin-auth-backend`
- CVE-2026-44374Backstage: Catalog unprocessed read endpoints allow authenticated cross-owner data access without permission checks
- CVE-2026-32237@backstage/plugin-scaffolder-backend: Possible exposure of defaultEnvironment secrets using dry-run endpoint
- CVE-2026-32236@backstage/plugin-auth-backend: SSRF in experimental CIMD metadata fetch
- CVE-2026-32235@backstage/plugin-auth-backend: OAuth redirect URI allowlist bypass
- CVE-2026-29186@backstage/plugin-techdocs-node: TechDocs Mkdocs Configuration Key Enables Arbitrary Code Execution
- CVE-2026-29184@backstage/plugin-scaffolder-backend: Potential Session Token Exfiltration via Log Redaction Bypass
- CVE-2026-29185@backstage/integration: Potential reading of SCM URLs using built in token
- CVE-2026-25152@backstage/plugin-techdocs-node vulnerable to possible Path Traversal in TechDocs Local Generator
- CVE-2026-25153@backstage/plugin-techdocs-node vulnerable to arbitrary code execution via MkDocs hooks
- CVE-2026-24048Backstage has a Possible SSRF when reading from allowed URL's in `backend.reading.allow`
- CVE-2026-24047@backstage/cli-common has a possible `resolveSafeChildPath` Symlink Chain Bypass
- CVE-2026-24046Backstage has a Possible Symlink Path Traversal in Scaffolder Actions
- CVE-2025-55285@backstage/plugin-scaffolder-backend Template Secret Leakage in Logs in Scaffolder When Using `fetch:template`
- CVE-2025-32791Permission policy information leakage in Backstage permission system
- CVE-2024-53983Server-side request forgery in Backstage Scaffolder plugin