6vulnerabilities
- Critical0 (0.0%)
- High2 (33.3%)
- Medium0 (0.0%)
- Moderate2 (33.3%)
- Low2 (33.3%)
backstage-backend-defaults
Ecosystem: npm
Downloads:
- 0CriticalAffects 0 versions
- 2HighAffects 4 versions
- 0MediumAffects 0 versions
- 2ModerateAffects 2 versions
- 2LowAffects 4 versions
Monthly breakdown
- Critical
- High
- Medium
- Moderate
- Low
- 4 vulnerabilities
- Critical: 0
- High: 1
- Medium: 0
- Moderate: 2
- Low: 1
- 2 vulnerabilities
- Critical: 0
- High: 1
- Medium: 0
- Moderate: 0
- Low: 1
Vulnerabilities (6)
Known vulnerabilities affecting backstage-backend-defaults, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-3xr5-8w6c-p5gw | Moderate | Backstage: Improper access control in backend action invocation### Impact An authenticated user could invoke actions that an operator had excluded through action configuration. Existing action permissions and downstream authorization remain enforced. ### Patches Patched in `@backstage/backend-defaults` version `0.17.8` ### Workarounds Limit access to action invocation endpoints to trusted service callers until upgrading. |
| GitHub (opens in a new tab) | |
| GHSA-7649-wm97-w3j3 | Moderate | Backstage: Improper input validation in cloud storage URL readers### Impact An attacker with write access to a cloud storage bucket used by Backstage could craft object names that could collide with protected files in the output directory. In certain deployment configurations, this could lead to content injection. ### Patches Patched in `@backstage/backend-defaults` version `0.17.8` |
| GitHub (opens in a new tab) | |
| GHSA-cq7v-rfgc-5c7v | High | Backstage: Improper preservation of access restrictions during service credential delegation### Impact An external service credential configured with access restrictions (e.g., read-only) could bypass those restrictions by routing requests through plugin delegation paths. This could allow a restricted service to perform operations beyond its intended scope, including write operations on plugins it was restricted to read-only access for. ### Patches Patched in `@backstage/backend-defaults` version `0.17.8` ### Workarounds If you're unable to upgrade immediately: - If practical, replace restricted credentials with separate, purpose-specific unrestricted credentials scoped to trus |
| GitHub (opens in a new tab) | |
| GHSA-xvh9-35w9-42m4 | Low | Backstage: Cloud storage catalog locations may cross configured storage boundaries### Impact Catalog entity providers for Azure Blob Storage and AWS S3 did not sufficiently validate storage object paths, which could allow catalog descriptors to be read from outside the intended storage boundary. Access is limited to locations reachable by the backend's configured credentials. ### Patches - `@backstage/plugin-catalog-backend-module-azure` version `0.3.21` - `@backstage/plugin-catalog-backend-module-aws` version `0.4.27` - `@backstage/backend-defaults` version `0.7.18` ### Workarounds - Restrict blob and object creation or renaming in configured catalog storage sources t |
| GitHub (opens in a new tab) | |
| GHSA-q2x5-4xjx-c6p9 | Low | Backstage has a Possible SSRF when reading from allowed URL's in `backend.reading.allow`### Impact The `FetchUrlReader` component, used by the catalog and other plugins to fetch content from URLs, followed HTTP redirects automatically. This allowed an attacker who controls a host listed in `backend.reading.allow` to redirect requests to internal or sensitive URLs that are not on the allowlist, bypassing the URL allowlist security control. This is a Server-Side Request Forgery (SSRF) vulnerability that could allow access to internal resources, but it does not allow attackers to include additional request headers. ### Patches This vulnerability is fixed in `@backstage/backend-d |
| GitHub (opens in a new tab) | |
| GHSA-rq6q-wr2q-7pgp | High | Backstage has a Possible Symlink Path Traversal in Scaffolder Actions### Impact Multiple Scaffolder actions and archive extraction utilities were vulnerable to symlink-based path traversal attacks. An attacker with access to create and execute Scaffolder templates could exploit symlinks to: 1. **Read arbitrary files** via the `debug:log` action by creating a symlink pointing to sensitive files (e.g., `/etc/passwd`, configuration files, secrets) 2. **Delete arbitrary files** via the `fs:delete` action by creating symlinks pointing outside the workspace 3. **Write files outside the workspace** via archive extraction (tar/zip) containing malicious symlinks This |
| GitHub (opens in a new tab) |
- GHSA-3xr5-8w6c-p5gwModerateBackstage: Improper access control in backend action invocation
< 0.17.8
### Impact An authenticated user could invoke actions that an operator had excluded through action configuration. Existing action permissions and downstream authorization remain enforced. ### Patches Patched in `@backstage/backend-defaults` version `0.17.8` ### Workarounds Limit access to action invocation endpoints to trusted service callers until upgrading.
CVE: CVE-2026-106495
- GHSA-7649-wm97-w3j3ModerateBackstage: Improper input validation in cloud storage URL readers
< 0.17.8
### Impact An attacker with write access to a cloud storage bucket used by Backstage could craft object names that could collide with protected files in the output directory. In certain deployment configurations, this could lead to content injection. ### Patches Patched in `@backstage/backend-defaults` version `0.17.8`
CVE: CVE-2026-106494
- GHSA-cq7v-rfgc-5c7vHighBackstage: Improper preservation of access restrictions during service credential delegation
< 0.17.8
### Impact An external service credential configured with access restrictions (e.g., read-only) could bypass those restrictions by routing requests through plugin delegation paths. This could allow a restricted service to perform operations beyond its intended scope, including write operations on plugins it was restricted to read-only access for. ### Patches Patched in `@backstage/backend-defaults` version `0.17.8` ### Workarounds If you're unable to upgrade immediately: - If practical, replace restricted credentials with separate, purpose-specific unrestricted credentials scoped to trus
CVE: CVE-2026-106492
- GHSA-xvh9-35w9-42m4LowBackstage: Cloud storage catalog locations may cross configured storage boundaries
< 0.17.8
### Impact Catalog entity providers for Azure Blob Storage and AWS S3 did not sufficiently validate storage object paths, which could allow catalog descriptors to be read from outside the intended storage boundary. Access is limited to locations reachable by the backend's configured credentials. ### Patches - `@backstage/plugin-catalog-backend-module-azure` version `0.3.21` - `@backstage/plugin-catalog-backend-module-aws` version `0.4.27` - `@backstage/backend-defaults` version `0.7.18` ### Workarounds - Restrict blob and object creation or renaming in configured catalog storage sources t
CVE: CVE-2026-106493
- GHSA-q2x5-4xjx-c6p9LowBackstage has a Possible SSRF when reading from allowed URL's in `backend.reading.allow`
< 0.12.2>= 0.13.0, < 0.13.2- +1 more
Affected versions:< 0.12.2>= 0.13.0, < 0.13.2>= 0.14.0, < 0.14.1
### Impact The `FetchUrlReader` component, used by the catalog and other plugins to fetch content from URLs, followed HTTP redirects automatically. This allowed an attacker who controls a host listed in `backend.reading.allow` to redirect requests to internal or sensitive URLs that are not on the allowlist, bypassing the URL allowlist security control. This is a Server-Side Request Forgery (SSRF) vulnerability that could allow access to internal resources, but it does not allow attackers to include additional request headers. ### Patches This vulnerability is fixed in `@backstage/backend-d
CVE: CVE-2026-24048
- GHSA-rq6q-wr2q-7pgpHighBackstage has a Possible Symlink Path Traversal in Scaffolder Actions
< 0.12.2>= 0.13.0, < 0.13.2- +1 more
Affected versions:< 0.12.2>= 0.13.0, < 0.13.2>= 0.14.0, < 0.14.1
### Impact Multiple Scaffolder actions and archive extraction utilities were vulnerable to symlink-based path traversal attacks. An attacker with access to create and execute Scaffolder templates could exploit symlinks to: 1. **Read arbitrary files** via the `debug:log` action by creating a symlink pointing to sensitive files (e.g., `/etc/passwd`, configuration files, secrets) 2. **Delete arbitrary files** via the `fs:delete` action by creating symlinks pointing outside the workspace 3. **Write files outside the workspace** via archive extraction (tar/zip) containing malicious symlinks This
CVE: CVE-2026-24046