Backstage - vulnerabilities (CVEs)

73 CVEs in 28 products, 43 in the last 30 days, newest from 2026-10-26.

Products

• Backstage - 69 CVEs
• Plugin-scaffolder-backend - 10 CVEs
• Plugin-techdocs-node - 8 CVEs
• Backend-defaults - 3 CVEs
• Plugin-catalog-backend - 3 CVEs
• Plugin-kubernetes-backend - 3 CVEs
• Plugin-auth-backend - 2 CVEs
• Plugin-proxy-backend - 2 CVEs
• Plugin-scaffolder-backend-module-bitbucket-cloud - 2 CVEs
• Plugin-scaffolder-backend-module-bitbucket-server - 2 CVEs
• Plugin-scaffolder-backend-module-confluence-to-markdown - 2 CVEs
• Plugin-techdocs-backend - 2 CVEs
• Plugin-auth-backend-module-cloudflare-access-provider - 1 CVEs
• Plugin-auth-backend-module-oidc-provider - 1 CVEs
• Plugin-auth-node - 1 CVEs
• Plugin-catalog-backend-module-aws - 1 CVEs
• Plugin-catalog-backend-module-azure - 1 CVEs
• Plugin-catalog-backend-module-bitbucket-server - 1 CVEs
• Plugin-catalog-backend-module-gitlab - 1 CVEs
• Plugin-catalog-backend-module-unprocessed - 1 CVEs
• Plugin-catalog-unprocessed-entities - 1 CVEs
• Plugin-catalog-unprocessed-entities-common - 1 CVEs
• Plugin-scaffolder-backend-module-azure - 1 CVEs
• Plugin-scaffolder-backend-module-github - 1 CVEs
• Plugin-scaffolder-backend-module-gitlab - 1 CVEs
• Plugin-scaffolder-backend-module-sentry - 1 CVEs
• Plugin-search-backend - 1 CVEs
• Plugin-search-backend-module-elasticsearch - 1 CVEs

Newest CVEs of Backstage

• CVE-2026-115923 - CVSS 6.5 (medium), 2026-10-26: Backstage is an open framework for building developer portals. Prior to 3.9.2 and from 4.0.0 until 4.0.2, DefaultCatalogRulesEnforcer in…
• CVE-2026-106495 - CVSS 4.3 (medium), 2026-10-12: Backstage is an open framework for building developer portals. Prior to 0.17.8, the @backstage/backend-defaults package is affected by improper access control…
• CVE-2026-106557 - CVSS 7.7 (high), 2026-10-07: Backstage is an open framework for building developer portals. Prior to 1.14.6 and 1.15.4, the @backstage/plugin-techdocs-node package did not sufficiently…
• CVE-2026-106563 - CVSS 6.5 (medium), 2026-10-07: Backstage is an open framework for building developer portals. Prior to 0.21.8, the @backstage/plugin-kubernetes-backend package is affected by improper…
• CVE-2026-106562 - CVSS 4.3 (medium), 2026-10-07: Backstage is an open framework for building developer portals. Prior to 2.1.6 in @backstage/plugin-search-backend and 1.8.7 in…
• CVE-2026-106561 - CVSS 5 (medium), 2026-10-07: Backstage is an open framework for building developer portals. Prior to 0.21.9, the @backstage/plugin-kubernetes-backend package is affected by sensitive…
• CVE-2026-106560 - CVSS 7.1 (high), 2026-10-07: Backstage is an open framework for building developer portals. Prior to 0.3.25, the @backstage/plugin-scaffolder-backend-module-confluence-to-markdown package…
• CVE-2026-106559 - CVSS 6.5 (medium), 2026-10-07: Backstage is an open framework for building developer portals. Prior to 0.3.25, the @backstage/plugin-scaffolder-backend-module-confluence-to-markdown package…
• CVE-2026-106558 - CVSS 8.8 (high), 2026-10-07: Backstage is an open framework for building developer portals. Prior to 1.14.8, 1.15.6, and 2.0.1, the @backstage/plugin-techdocs-node package improperly…
• CVE-2026-106556 - CVSS 7.7 (high), 2026-10-07: Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by configuration…
• CVE-2026-106510 - CVSS 7.7 (high), 2026-10-07: Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by remote code…
• CVE-2026-106509 - CVSS 8.8 (high), 2026-10-06: Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by improper validation…
• CVE-2026-106508 - CVSS 6.5 (medium), 2026-10-06: Backstage is an open framework for building developer portals. Prior to 1.15.4, the @backstage/plugin-techdocs-node package is affected by potential file…
• CVE-2026-106507 - CVSS 6.5 (medium), 2026-10-06: Backstage is an open framework for building developer portals. Prior to 1.15.4, the @backstage/plugin-techdocs-node package is affected by techdocs arbitrary…
• CVE-2026-106506 - CVSS 5.3 (medium), 2026-10-06: Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by improper input…
• CVE-2026-106505 - CVSS 8.5 (high), 2026-10-06: Backstage is an open framework for building developer portals. Prior to 1.14.6 and 1.15.4, the @backstage/plugin-techdocs-node package is affected by bypass…
• CVE-2026-106504 - CVSS 6.5 (medium), 2026-10-06: Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by sensitive…
• CVE-2026-106503 - CVSS 8.1 (high), 2026-10-06: Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is…
• CVE-2026-106502 - CVSS 5.3 (medium), 2026-10-06: Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package could expose sensitive…
• CVE-2026-106501 - CVSS 9.6 (critical), 2026-10-06: Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is…
• CVE-2026-106500 - CVSS 8.5 (high), 2026-10-06: Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is…
• CVE-2026-106499 - CVSS 4.9 (medium), 2026-10-06: Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package could expose secret-derived…
• CVE-2026-106498 - CVSS 7.7 (high), 2026-10-06: Backstage is an open framework for building developer portals. Prior to 3.5.1, 3.6.2, 3.7.2, 3.8.2 and 3.9.1, the @backstage/plugin-catalog-backend package is…
• CVE-2026-106497 - CVSS 4.3 (medium), 2026-10-06: Backstage is an open framework for building developer portals. Prior to 3.9.1, the @backstage/plugin-catalog-backend package is affected by inconsistent…
• CVE-2026-106496 - CVSS 6.5 (medium), 2026-10-06: Backstage is an open framework for building developer portals. Prior to 3.9.1, the @backstage/plugin-catalog-backend package is affected by inconsistent…
• CVE-2026-106494 - CVSS 4.9 (medium), 2026-10-06: Backstage is an open framework for building developer portals. Prior to 0.17.8, the @backstage/backend-defaults package is affected by improper input…
• CVE-2026-106493 - CVSS 4.1 (medium), 2026-10-06: Backstage is an open framework for building developer portals. Prior to 1.54.6, cloud storage catalog providers did not sufficiently validate object paths. A…
• CVE-2026-106492 - CVSS 7.6 (high), 2026-10-06: Backstage is an open framework for building developer portals. Prior to 0.16.1 and 0.17.8, the @backstage/backend-defaults package is affected by improper…
• CVE-2026-106491 - CVSS 6.4 (medium), 2026-10-06: Backstage is an open framework for building developer portals. Prior to 0.6.17, the @backstage/plugin-proxy-backend package is affected by improper input…
• CVE-2026-106490 - CVSS 6.5 (medium), 2026-10-06: Backstage is an open framework for building developer portals. Prior to 2.2.4, the @backstage/plugin-techdocs-backend package is affected by improper input…