Independent & educational platform Not a government body. No link or affiliation with any government organisation. Made for learning only. Test only systems you own or are authorised to test. Become a Partner or Sponsor → Full disclaimer

CVE-2026-106498

high

Backstage is an open framework for building developer portals.

Vendor / product: Linuxfoundation — backstage plugin-catalog-backend

Backstage is an open framework for building developer portals. Prior to 3.5.1, 3.6.2, 3.7.2, 3.8.2 and 3.9.1, the @backstage/plugin-catalog-backend package is affected by improper url validation in catalog entity placeholder resolution. An authenticated Backstage user could craft a catalog entity with placeholder directives that reference resources outside the entity's source repository. Under certain configurations, this could allow access to data not intended to be available to the user. This issue is fixed in versions 3.5.1, 3.6.2, 3.7.2, 3.8.2 and 3.9.1.

CVSS
7.7
7.7 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Severity source: NVD CVSS v3.1 (security-advisories@github.com)
Timeline (UTC)
Published: 2026-10-06 22:17
Modified: 2026-10-16 15:22
NVD status: Analyzed
Last synced 2 days ago
Verified against the source API 2026-10-27 06:58 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).

Affected products

linuxfoundation / backstage_plugin-catalog-backend <3.5.1, ≥3.6.0 <3.6.2, ≥3.7.0 <3.7.2, ≥3.8.0 <3.8.2, ≥3.9.0 <3.9.1
linuxfoundation / backstage <1.49.6, ≥1.50.0 <1.50.5, ≥1.51.0 <1.51.3, ≥1.52.0 <1.53.2, ≥1.54.0 <1.54.6

Weakness classification (CWE)

CWE-863 CWE-918

Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.

Mitigation & advisories

Vendor advisory: https://github.com/backstage/backstage/security/advisories/GHSA-qgvj-qcf8-xq73
Patch / mitigation: https://github.com/backstage/backstage/commit/0b0f6fc89b4eb4872c76a498abbe1dc65998bb6e
Patch / mitigation: https://github.com/backstage/backstage/commit/286bfc1f9cc3608a073b41016be302785be385d1
Patch / mitigation: https://github.com/backstage/backstage/commit/61a10f19926aeda7f4a32de48d733e6710584634
Patch / mitigation: https://github.com/backstage/backstage/commit/99729e925fd2bd40ba210022351a0ee6318e6197
Patch / mitigation: https://github.com/backstage/backstage/commit/e786ac309ed2d775daf2309393c015c43902d6f6
Patch / mitigation: https://github.com/backstage/backstage/releases/tag/v1.49.6
Patch / mitigation: https://github.com/backstage/backstage/releases/tag/v1.50.5
Patch / mitigation: https://github.com/backstage/backstage/releases/tag/v1.51.3
Patch / mitigation: https://github.com/backstage/backstage/releases/tag/v1.53.2
Patch / mitigation: https://github.com/backstage/backstage/releases/tag/v1.54.6

References

Data sources

NVD CVE API 2.0 — fetched 2026-10-27 06:58 UTC · record ↗

Learn the basics

Understanding CVEs and CVSS Scores

Related CVEs

CVE-2026-106456CVE-2026-106457CVE-2026-106458CVE-2026-106460CVE-2026-104252