Backstage (Linuxfoundation) - vulnerabilities (CVEs)

53 CVEs, 40 in the last 30 days, 719 known versions, newest CVE from 2026-10-07. Vendor: Linuxfoundation.

CVEs of Backstage

• CVE-2026-106563 - CVSS 6.5 (medium), 2026-10-07: Backstage is an open framework for building developer portals. Prior to 0.21.8, the @backstage/plugin-kubernetes-backend package is affected by improper…
• CVE-2026-106562 - CVSS 4.3 (medium), 2026-10-07: Backstage is an open framework for building developer portals. Prior to 2.1.6 in @backstage/plugin-search-backend and 1.8.7 in…
• CVE-2026-106561 - CVSS 5 (medium), 2026-10-07: Backstage is an open framework for building developer portals. Prior to 0.21.9, the @backstage/plugin-kubernetes-backend package is affected by sensitive…
• CVE-2026-106560 - CVSS 7.1 (high), 2026-10-07: Backstage is an open framework for building developer portals. Prior to 0.3.25, the @backstage/plugin-scaffolder-backend-module-confluence-to-markdown package…
• CVE-2026-106559 - CVSS 6.5 (medium), 2026-10-07: Backstage is an open framework for building developer portals. Prior to 0.3.25, the @backstage/plugin-scaffolder-backend-module-confluence-to-markdown package…
• CVE-2026-106558 - CVSS 8.8 (high), 2026-10-07: Backstage is an open framework for building developer portals. Prior to 1.14.8, 1.15.6, and 2.0.1, the @backstage/plugin-techdocs-node package improperly…
• CVE-2026-106556 - CVSS 7.7 (high), 2026-10-07: Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by configuration…
• CVE-2026-106510 - CVSS 7.7 (high), 2026-10-07: Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by remote code…
• CVE-2026-106509 - CVSS 8.8 (high), 2026-10-06: Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by improper validation…
• CVE-2026-106508 - CVSS 6.5 (medium), 2026-10-06: Backstage is an open framework for building developer portals. Prior to 1.15.4, the @backstage/plugin-techdocs-node package is affected by potential file…
• CVE-2026-106507 - CVSS 6.5 (medium), 2026-10-06: Backstage is an open framework for building developer portals. Prior to 1.15.4, the @backstage/plugin-techdocs-node package is affected by techdocs arbitrary…
• CVE-2026-106506 - CVSS 5.3 (medium), 2026-10-06: Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by improper input…
• CVE-2026-106505 - CVSS 8.5 (high), 2026-10-06: Backstage is an open framework for building developer portals. Prior to 1.14.6 and 1.15.4, the @backstage/plugin-techdocs-node package is affected by bypass…
• CVE-2026-106504 - CVSS 6.5 (medium), 2026-10-06: Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by sensitive…
• CVE-2026-106503 - CVSS 8.1 (high), 2026-10-06: Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is…
• CVE-2026-106502 - CVSS 5.3 (medium), 2026-10-06: Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package could expose sensitive…
• CVE-2026-106501 - CVSS 9.6 (critical), 2026-10-06: Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is…
• CVE-2026-106500 - CVSS 8.5 (high), 2026-10-06: Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is…
• CVE-2026-106499 - CVSS 4.9 (medium), 2026-10-06: Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package could expose secret-derived…
• CVE-2026-106498 - CVSS 7.7 (high), 2026-10-06: Backstage is an open framework for building developer portals. Prior to 3.5.1, 3.6.2, 3.7.2, 3.8.2 and 3.9.1, the @backstage/plugin-catalog-backend package is…
• CVE-2026-106497 - CVSS 4.3 (medium), 2026-10-06: Backstage is an open framework for building developer portals. Prior to 3.9.1, the @backstage/plugin-catalog-backend package is affected by inconsistent…
• CVE-2026-106496 - CVSS 6.5 (medium), 2026-10-06: Backstage is an open framework for building developer portals. Prior to 3.9.1, the @backstage/plugin-catalog-backend package is affected by inconsistent…
• CVE-2026-106494 - CVSS 4.9 (medium), 2026-10-06: Backstage is an open framework for building developer portals. Prior to 0.17.8, the @backstage/backend-defaults package is affected by improper input…
• CVE-2026-106493 - CVSS 4.1 (medium), 2026-10-06: Backstage is an open framework for building developer portals. Prior to 1.54.6, cloud storage catalog providers did not sufficiently validate object paths. A…
• CVE-2026-106492 - CVSS 7.6 (high), 2026-10-06: Backstage is an open framework for building developer portals. Prior to 0.16.1 and 0.17.8, the @backstage/backend-defaults package is affected by improper…
• CVE-2026-106491 - CVSS 6.4 (medium), 2026-10-06: Backstage is an open framework for building developer portals. Prior to 0.6.17, the @backstage/plugin-proxy-backend package is affected by improper input…
• CVE-2026-106490 - CVSS 6.5 (medium), 2026-10-06: Backstage is an open framework for building developer portals. Prior to 2.2.4, the @backstage/plugin-techdocs-backend package is affected by improper input…
• CVE-2026-106489 - CVSS 6.5 (medium), 2026-10-06: Backstage is an open framework for building developer portals. Prior to 2.2.4, the @backstage/plugin-techdocs-backend package is affected by improper…
• CVE-2026-106488 - CVSS 8.1 (high), 2026-10-06: Backstage is an open framework for building developer portals. Prior to 0.4.20, the @backstage/plugin-auth-backend-module-oidc-provider package is affected by…
• CVE-2026-106487 - CVSS 5 (medium), 2026-10-06: Backstage is an open framework for building developer portals. Prior to 0.21.10, the @backstage/plugin-kubernetes-backend package is affected by unsupported…
• CVE-2026-106486 - CVSS 9.9 (critical), 2026-10-06: Backstage is an open framework for building developer portals. Prior to 0.3.10 in @backstage/plugin-scaffolder-backend-module-bitbucket-cloud and 0.2.25 in…
• CVE-2026-106463 - CVSS 5.4 (medium), 2026-10-06: Backstage is an open framework for building developer portals. Prior to 0.8.7, the @backstage/plugin-catalog-backend-module-gitlab package is affected by…
• CVE-2026-106462 - CVSS 6.4 (medium), 2026-10-06: Backstage is an open framework for building developer portals. Prior to 1.54.6, scaffolder source-control actions may not consistently enforce intended…
• CVE-2026-106461 - CVSS 4.3 (medium), 2026-10-06: Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by incorrect…
• CVE-2026-106460 - CVSS 6.8 (medium), 2026-10-06: Backstage is an open framework for building developer portals. From 0.3.0 until 0.6.15 and 0.7.5, the @backstage/plugin-auth-node package did not consistently…
• CVE-2026-106459 - CVSS 8.5 (high), 2026-10-06: Backstage is an open framework for building developer portals. From 0.3.0 until 0.3.8, the @backstage/plugin-scaffolder-backend-module-sentry package is…
• CVE-2026-106458 - CVSS 6.5 (medium), 2026-10-06: Backstage is an open framework for building developer portals. From 0.4.0 until 0.5.15, the @backstage/plugin-catalog-backend-module-bitbucket-server package…
• CVE-2026-106457 - CVSS 8.1 (high), 2026-10-06: Backstage is an open framework for building developer portals. From 0.1.0 until 0.5.0, the @backstage/plugin-auth-backend-module-cloudflare-access-provider…
• CVE-2026-106456 - CVSS 6.5 (medium), 2026-10-06: Backstage is an open framework for building developer portals. From 0.5.0 until 0.6.18, the @backstage/plugin-proxy-backend package is affected by…
• CVE-2026-106455 - CVSS 7.7 (high), 2026-10-06: Backstage is an open framework for building developer portals. From 0.11.12 until 1.14.7 and 1.15.5, the @backstage/plugin-techdocs-node package is affected…
• CVE-2026-88064 - CVSS 8.8 (high), 2026-09-16: Backstage is an open framework for building developer portals. Prior to 1.14.6 and from 1.15.0 until 1.15.4, the @backstage/plugin-techdocs-node package…
• CVE-2026-32236 - CVSS 7.5 (high), 2026-03-12: Backstage is an open framework for building developer portals. Prior to 0.27.1, a Server-Side Request Forgery (SSRF) vulnerability exists in…
• CVE-2026-32235 - CVSS 5.9 (medium), 2026-03-12: Backstage is an open framework for building developer portals. Prior to 0.27.1, the experimental OIDC provider in @backstage/plugin-auth-backend is vulnerable…
• CVE-2026-25152 - CVSS 6.5 (medium), 2026-01-30: Backstage is an open framework for building developer portals, and @backstage/plugin-techdocs-node provides common node.js functionalities for TechDocs. In…
• CVE-2026-25153 - CVSS 8.8 (high), 2026-01-30: Backstage is an open framework for building developer portals, and @backstage/plugin-techdocs-node provides common node.js functionalities for TechDocs. In…
• CVE-2024-45815 - CVSS 6.5 (medium), 2024-09-17: Backstage is an open framework for building developer portals. A malicious actor with authenticated access to a Backstage instance with the catalog backend…
• CVE-2024-46976 - CVSS 6.5 (medium), 2024-09-17: Backstage is an open framework for building developer portals. An attacker with control of the contents of the TechDocs storage buckets is able to inject…
• CVE-2024-45816 - CVSS 6.5 (medium), 2024-09-17: Backstage is an open framework for building developer portals. When using the AWS S3 or GCS storage provider for TechDocs it is possible to access content in…
• CVE-2023-6944 - CVSS 5.7 (medium), 2024-01-04: A flaw was found in the Red Hat Developer Hub (RHDH). The catalog-import function leaks GitLab access tokens on the frontend when the base64 encoded GitLab…
• CVE-2023-35926 - CVSS 9.9 (critical), 2023-06-22: Backstage is an open platform for building developer portals. The Backstage scaffolder-backend plugin uses a templating library that requires sandbox, as it…
• CVE-2021-43783 - CVSS 8.5 (high), 2021-11-29: @backstage/plugin-scaffolder-backend is the backend for the default Backstage software templates. In affected versions a malicious actor with write access to…
• CVE-2021-41151 - CVSS 6.8 (medium), 2021-10-18: Backstage is an open platform for building developer portals. In affected versions A malicious actor could read sensitive files from the environment where…
• CVE-2021-32662 - CVSS 6.5 (medium), 2021-06-03: Backstage is an open platform for building developer portals, and techdocs-common contains common functionalities for Backstage's TechDocs. In…