CVE-2026-106493
mediumBackstage is an open framework for building developer portals.
Vendor / product: Linuxfoundation — backstage
Backstage is an open framework for building developer portals. Prior to 1.54.6, cloud storage catalog providers did not sufficiently validate object paths. A principal able to create or rename objects in a configured Azure Blob Storage or AWS S3 catalog source could cause catalog descriptors to be read from outside the intended storage boundary, limited to locations reachable with the backend's configured credentials. This issue is fixed in 1.54.6.
CVSS
4.1
4.1 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N Severity source: NVD CVSS v3.1 (nvd@nist.gov)
Timeline (UTC)
Published: 2026-10-06 21:17
Modified: 2026-10-22 13:13
NVD status: Analyzed
Last synced 2 days ago
Verified against the source API 2026-10-27 06:58 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
linuxfoundation / backstage <1.54.6
linuxfoundation / backstage\/backend-defaults <0.17.8
linuxfoundation / backstage\/plugin-catalog-backend-module-aws <0.4.27
linuxfoundation / backstage\/plugin-catalog-backend-module-azure <0.3.21
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Patch / mitigation: https://github.com/backstage/backstage/commit/47ddbd8b4a3efd812309f759c38f4877fbd9e5ff
Patch / mitigation: https://github.com/backstage/backstage/releases/tag/v1.54.6
Patch / mitigation: https://github.com/backstage/backstage/security/advisories/GHSA-xvh9-35w9-42m4
References
- https://github.com/backstage/backstage/commit/47ddbd8b4a3efd812309f759c38f4877fbd9e5ff security-advisories@github.com
- https://github.com/backstage/backstage/releases/tag/v1.54.6 security-advisories@github.com
- https://github.com/backstage/backstage/security/advisories/GHSA-xvh9-35w9-42m4 security-advisories@github.com
Data sources
NVD CVE API 2.0 — fetched 2026-10-27 06:58 UTC · record ↗