Vulnerabilities in backstage
69 resultsCVE-2026-106459HIGHBackstage: Improper input validation in Sentry scaffolder actionsEPSS 0.2%CVE-2026-106492HIGHBackstage: Improper preservation of access restrictions during service credential delegationEPSS 0.2%CVE-2026-106561MEDIUMBackstage: Sensitive information disclosure in Kubernetes resource queriesEPSS 0.2%CVE-2026-106562MEDIUMBackstage: Incorrect authorization in search engine permission filteringEPSS 0.2%CVE-2026-106497MEDIUMBackstage: Inconsistent catalog property permission evaluationEPSS 0.2%CVE-2026-106461MEDIUMBackstage: Incorrect authorization in scaffolder task listingEPSS 0.2%CVE-2026-106462MEDIUMBackstage: Scaffolder credential handling may allow unintended GitHub authentication fallbackEPSS 0.2%CVE-2026-106463MEDIUMBackstage: Improper authorization in GitLab organizational user ingestionEPSS 0.2%CVE-2026-73563MEDIUMBackstage: Unauthenticated OAuth account takeover via `redirect_uri` allowlist bypass in `@backstage/plugin-auth-backend`EPSS 0.2%