CVE-2026-106487
CVE-2026-106487 · Backstage: Unsupported catalog cluster authentication mode in kubernetes backend
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
Backstage is an open framework for building developer portals. Prior to 0.21.10, the @backstage/plugin-kubernetes-backend package is affected by unsupported catalog cluster authentication mode in kubernetes backend. Deployments using catalog cluster discovery may be affected when catalog contributors can create or modify kubernetes-cluster Resource entities. With the required endpoint permissions and pod RBAC, the backend can use its local in-cluster identity, potentially exposing Kubernetes resources readable by that identity. The credential is used only with the local in-cluster API endpoint and is not sent to the catalog-supplied endpoint. This issue is fixed in version 0.21.10.
CVSS 3.5 · Faible · EPSS 0,3% · Correctif disponible
- Publication
- Mise à jour
Pile logicielle: node
Produits et versions concernés
backstage
- Versions du logiciel
- < 1.54.6: Concernée
Aucun correctif publié
plugin-kubernetes-backend
- Versions du logiciel
- < 0.21.10: Concernée
Aucun correctif publié
@backstage/plugin-kubernetes-backend npm
- Plages de versions concernées
- SEMVER: < 0.21.10
Mettez à jour vers 0.21.10