{"id":"CVE-2026-106498","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T22:17:04.713","lastModified":"2026-10-16T15:22:13.790","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Backstage is an open framework for building developer portals. Prior to 3.5.1, 3.6.2, 3.7.2, 3.8.2 and 3.9.1, the @backstage/plugin-catalog-backend package is affected by improper url validation in catalog entity placeholder resolution. An authenticated Backstage user could craft a catalog entity with placeholder directives that reference resources outside the entity's source repository. Under certain configurations, this could allow access to data not intended to be available to the user. This issue is fixed in versions 3.5.1, 3.6.2, 3.7.2, 3.8.2 and 3.9.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"backstage","product":"backstage","versions":[{"version":"< 1.49.6","status":"affected"},{"version":">= 1.50.0-next.0, < 1.50.5","status":"affected"},{"version":">= 1.51.0-next.0, < 1.51.3","status":"affected"},{"version":">= 1.52.0-next.0, < 1.53.2","status":"affected"},{"version":">= 1.54.0-next.0, < 1.54.6","status":"affected"}]},{"vendor":"@backstage","product":"plugin-catalog-backend","versions":[{"version":"< 3.5.1","status":"affected"},{"version":">= 3.6.0, < 3.6.2","status":"affected"},{"version":">= 3.7.0, < 3.7.2","status":"affected"},{"version":">= 3.8.0, < 3.8.2","status":"affected"},{"version":">= 3.9.0, < 3.9.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":4.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-09T01:54:51.540668Z","id":"CVE-2026-106498","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"},{"lang":"en","value":"CWE-918"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage_plugin-catalog-backend:*:*:*:*:*:node.js:*:*","versionEndExcluding":"3.5.1","matchCriteriaId":"E352863A-473B-4E3D-B274-1AEDA83923A2"},{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage_plugin-catalog-backend:*:*:*:*:*:node.js:*:*","versionStartIncluding":"3.6.0","versionEndExcluding":"3.6.2","matchCriteriaId":"64717908-A121-43E2-83FF-56E1BC786A9C"},{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage_plugin-catalog-backend:*:*:*:*:*:node.js:*:*","versionStartIncluding":"3.7.0","versionEndExcluding":"3.7.2","matchCriteriaId":"1E1F3A76-5F43-4C34-880F-5082BA0FBD8E"},{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage_plugin-catalog-backend:*:*:*:*:*:node.js:*:*","versionStartIncluding":"3.8.0","versionEndExcluding":"3.8.2","matchCriteriaId":"3A2CAA96-1B99-41FC-AF0C-216DAB8EE659"},{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage_plugin-catalog-backend:*:*:*:*:*:node.js:*:*","versionStartIncluding":"3.9.0","versionEndExcluding":"3.9.1","matchCriteriaId":"7F0C2290-97C5-404F-B9E1-05A9335E6B82"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*","versionEndExcluding":"1.49.6","matchCriteriaId":"8D095FA7-D58D-4B37-84B2-0E565FF215C1"},{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*","versionStartIncluding":"1.50.0","versionEndExcluding":"1.50.5","matchCriteriaId":"DC5B9818-20D9-4507-80D2-6242DED888AE"},{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*","versionStartIncluding":"1.51.0","versionEndExcluding":"1.51.3","matchCriteriaId":"5E1B77C6-895E-4F0A-8195-2533B5FD7847"},{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*","versionStartIncluding":"1.52.0","versionEndExcluding":"1.53.2","matchCriteriaId":"E18CFF79-956B-4F89-A34E-31FE85217BF2"},{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*","versionStartIncluding":"1.54.0","versionEndExcluding":"1.54.6","matchCriteriaId":"D3E2CBFE-A84D-4D5C-BF4E-E4460AB99E18"}]}]}],"references":[{"url":"https://github.com/backstage/backstage/commit/0b0f6fc89b4eb4872c76a498abbe1dc65998bb6e","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/backstage/backstage/commit/286bfc1f9cc3608a073b41016be302785be385d1","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/backstage/backstage/commit/61a10f19926aeda7f4a32de48d733e6710584634","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/backstage/backstage/commit/99729e925fd2bd40ba210022351a0ee6318e6197","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/backstage/backstage/commit/e786ac309ed2d775daf2309393c015c43902d6f6","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.49.6","source":"security-advisories@github.com","tags":["Patch","Release Notes"]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.50.5","source":"security-advisories@github.com","tags":["Patch","Release Notes"]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.51.3","source":"security-advisories@github.com","tags":["Patch","Release Notes"]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.53.2","source":"security-advisories@github.com","tags":["Patch","Release Notes"]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.54.6","source":"security-advisories@github.com","tags":["Patch","Release Notes"]},{"url":"https://github.com/backstage/backstage/security/advisories/GHSA-qgvj-qcf8-xq73","source":"security-advisories@github.com","tags":["Mitigation","Vendor Advisory"]}]}