CVE-2026-106498highCWE-863 CWE-918

CVE-2026-106498: high-severity vulnerability in backstage

Backstage: Improper URL validation in catalog entity placeholder resolution

Published 06 Oct 2026

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.7epss 0.3%

exploitation probability

0.3%top 78% of all CVEs

observed exploitation

nono source reports it

Backstage is an open framework for building developer portals. Prior to 3.5.1, 3.6.2, 3.7.2, 3.8.2 and 3.9.1, the @backstage/plugin-catalog-backend package is affected by improper url validation in catalog entity placeholder resolution. An authenticated Backstage user could craft a catalog entity with placeholder directives that reference resources outside the entity's source repository. Under certain configurations, this could allow access to data not intended to be available to the user. This issue is fixed in versions 3.5.1, 3.6.2, 3.7.2, 3.8.2 and 3.9.1.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Affected products

@backstage · plugin-catalog-backend backstage · backstage

Related CVEs — backstage

In the same product, most dangerous first.

CVE-2023-35926HIGHInsecure sandbox in Backstage Scaffolder pluginEPSS 1.9%CVE-2021-41151MEDIUMPath Traversal in @backstage/plugin-scaffolder-backendEPSS 1.3%CVE-2021-32662MEDIUMTechDocs mkdocs.yml path traversalEPSS 1.3%CVE-2021-32660MEDIUMTechDocs content sanitization bypassEPSS 1.3%CVE-2021-43783HIGHPath Traversal in @backstage/plugin-scaffolder-backendEPSS 1.2%CVE-2021-32661MEDIUMTechDocs object element script injectionEPSS 1.2%

References