{"id":"EUVD-2026-94005","enisaUuid":"ae101f15-4a93-3958-a8b8-60539dbf7c49","description":"Backstage is an open framework for building developer portals. Prior to 0.21.10, the @backstage/plugin-kubernetes-backend package is affected by unsupported catalog cluster authentication mode in kubernetes backend. Deployments using catalog cluster discovery may be affected when catalog contributors can create or modify kubernetes-cluster Resource entities. With the required endpoint permissions and pod RBAC, the backend can use its local in-cluster identity, potentially exposing Kubernetes resources readable by that identity. The credential is used only with the local in-cluster API endpoint and is not sent to the catalog-supplied endpoint. This issue is fixed in version 0.21.10.","datePublished":"Oct 6, 2026, 8:36:45 PM","dateUpdated":"Oct 9, 2026, 1:49:45 AM","baseScore":3.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N","references":"https://github.com/backstage/backstage/security/advisories/GHSA-h53x-hjx6-25gr\nhttps://github.com/backstage/backstage/commit/c14f8be6908f0f719b16356e5492352311e28946\nhttps://github.com/backstage/backstage/releases/tag/v1.54.6\n","aliases":"CVE-2026-106487\nGHSA-h53x-hjx6-25gr\n","assigner":"GitHub_M","epss":0.26,"enisaIdProduct":[{"id":"31e5cf28-7821-3203-a1d3-56ddbe8204cb","product":{"name":"backstage","vendor":{"name":"backstage"}},"product_version":"\u003c 1.54.6"},{"id":"74028e21-d131-3aea-928d-f8fdf49af238","product":{"name":"plugin-kubernetes-backend","vendor":{"name":"@backstage"}},"product_version":"\u003c 0.21.10"}],"enisaIdVendor":[{"id":"d9f67223-fb8a-3c7b-95e3-07827d6a6d75","vendor":{"name":"@backstage"}},{"id":"ee7307be-5603-3a0b-9737-55bcf6a37935","vendor":{"name":"backstage"}}],"enisaIdVulnerability":[{"id":"3c0c5405-ac49-32f9-b757-1d8afbe15f4d","vulnerability":{"id":"GHSA-h53x-hjx6-25gr","description":"Backstage: Unsupported catalog cluster authentication mode in kubernetes backend","datePublished":"Oct 7, 2026, 6:01:08 PM","dateUpdated":"Oct 7, 2026, 6:01:08 PM","baseScore":0.0,"references":"https://github.com/backstage/backstage/security/advisories/GHSA-h53x-hjx6-25gr\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-106487\nhttps://github.com/backstage/backstage/commit/c14f8be6908f0f719b16356e5492352311e28946\nhttps://github.com/backstage/backstage\nhttps://github.com/backstage/backstage/releases/tag/v1.54.6\n","enisa_id":"EUVD-2026-94005\n","aliases":"GHSA-h53x-hjx6-25gr\nCVE-2026-106487\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:07:07 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"735db449-74b4-3b9f-8235-e3c4ba5f504e","vulnerability":{"id":"CVE-2026-106487","description":"Backstage is an open framework for building developer portals. Prior to 0.21.10, the @backstage/plugin-kubernetes-backend package is affected by unsupported catalog cluster authentication mode in kubernetes backend. Deployments using catalog cluster discovery may be affected when catalog contributors can create or modify kubernetes-cluster Resource entities. With the required endpoint permissions and pod RBAC, the backend can use its local in-cluster identity, potentially exposing Kubernetes resources readable by that identity. The credential is used only with the local in-cluster API endpoint and is not sent to the catalog-supplied endpoint. This issue is fixed in version 0.21.10.","datePublished":"Oct 6, 2026, 8:36:45 PM","dateUpdated":"Oct 9, 2026, 1:49:45 AM","status":"PUBLISHED","baseScore":3.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N","references":"https://github.com/backstage/backstage/security/advisories/GHSA-h53x-hjx6-25gr\nhttps://github.com/backstage/backstage/commit/c14f8be6908f0f719b16356e5492352311e28946\nhttps://github.com/backstage/backstage/releases/tag/v1.54.6\n","enisa_id":"EUVD-2026-94005\n","assigner":"GitHub_M","epss":0.26,"dataProcessed":"Nov 2, 2026, 7:16:59 AM","vulnerabilityProduct":[{"id":"8a1d7b1a-bf10-3877-b2bf-ee103e30b241","product":{"name":"backstage","vendor":{"name":"backstage"}},"product_version":"\u003c 1.54.6"},{"id":"b799bac3-1d53-3e04-8f37-903aa3b67e3b","product":{"name":"plugin-kubernetes-backend","vendor":{"name":"@backstage"}},"product_version":"\u003c 0.21.10"}],"vulnerabilityVendor":[{"id":"93155a23-9406-3ba3-b364-4e3d1e96c33c","vendor":{"name":"backstage"}},{"id":"fc85d333-4cbc-3930-bff5-d9ca55aa485d","vendor":{"name":"@backstage"}}]}}],"enisaIdAdvisory":[]}