p PatchFirst

CVE-2026-106498

CVE-2026-106498 · Backstage: Improper URL validation in catalog entity placeholder resolution

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Backstage is an open framework for building developer portals. Prior to 3.5.1, 3.6.2, 3.7.2, 3.8.2 and 3.9.1, the @backstage/plugin-catalog-backend package is affected by improper url validation in catalog entity placeholder resolution. An authenticated Backstage user could craft a catalog entity with placeholder directives that reference resources outside the entity's source repository. Under certain configurations, this could allow access to data not intended to be available to the user. This issue is fixed in versions 3.5.1, 3.6.2, 3.7.2, 3.8.2 and 3.9.1.

CVSS 7.7 · High · EPSS 0.3% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • backstage

    Versions
    • < 1.49.6: Affected
    • >= 1.50.0-next.0, < 1.50.5: Affected
    • >= 1.51.0-next.0, < 1.51.3: Affected
    • >= 1.52.0-next.0, < 1.53.2: Affected
    • >= 1.54.0-next.0, < 1.54.6: Affected

    No fix published

  • plugin-catalog-backend

    Versions
    • < 3.5.1: Affected
    • >= 3.6.0, < 3.6.2: Affected
    • >= 3.7.0, < 3.7.2: Affected
    • >= 3.8.0, < 3.8.2: Affected
    • >= 3.9.0, < 3.9.1: Affected

    No fix published

  • @backstage/plugin-catalog-backend npm

    Affected ranges
    • SEMVER: < 3.9.1

    Update to 3.9.1

Original sources

Check your server →