GitHub Advisoryadvisory · npm

GHSA-qgvj-qcf8-xq73 Backstage: Improper URL validation in catalog entity placeholder resolution

HIGH Published 2026-10-07 Modified 2026-10-07 Official page ↗
Aliases
CVE-2026-106498
Ecosystem
npm
Packages
@backstage/plugin-catalog-backend
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Weaknesses
CWE-863, CWE-918
Reviewed
2026-10-07

Affected packages

• npm @backstage/plugin-catalog-backend: < 3.9.1 → fixed in 3.9.1

Description

Impact An authenticated Backstage user could craft a catalog entity with placeholder directives that reference resources outside the entity's source repository. Under certain configurations, this could allow access to data not intended to be available to the user. Patches Patched in `@backstage/plugin-catalog-backend` version `3.9.1` Workarounds If you're not able to update immediately: • Limit the scope of integration credentials (e.g., GitHub tokens) to only the repositories that Backstage needs to access.

Related

Alias · CVE (1)

  • CVE-2026-106498 Backstage is an open framework for building developer portals. vulnerability

Weakness · CWE (2)

  • CWE-863 Incorrect Authorization weakness
  • CWE-918 Server-Side Request Forgery weakness

References