---
id: CVE-2026-106494
title: Backstage is an open framework for building developer portals
summary: >-
  Backstage is an open framework for building developer portals. Prior to
  0.17.8, the @backstage/backend-defaults package is affected by improper input
  validation in cloud storage url readers. An attacker with write access to a
  cloud stora…
severity: medium
cvss: 4.4
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N'
cwe:
  - CWE-22
  - CWE-73
vendor: backstage
product: backstage
affected:
  - backstage < 1.54.6
  - backend-defaults < 0.17.8
published: '2026-10-06'
updated: '2026-10-07'
sourceUpdated: '2026-10-07T16:17:39.403'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-106494'
references:
  - url: >-
      https://github.com/backstage/backstage/commit/14e925ce5b905dd8daa64c3009722febda76034c
    label: security-advisories@github.com
  - url: 'https://github.com/backstage/backstage/releases/tag/v1.54.6'
    label: security-advisories@github.com
  - url: >-
      https://github.com/backstage/backstage/security/advisories/GHSA-7649-wm97-w3j3
    label: security-advisories@github.com
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106494.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-106494'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2547198'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-106494'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-106494'
  - url: 'https://github.com/advisories/GHSA-7649-wm97-w3j3'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
  - ghsa
  - npm
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-07T15:31:02.764800Z'
ingestedAt: '2026-10-06T21:20:28.986Z'
aliases:
  - GHSA-7649-wm97-w3j3
ecosystem: npm
patched:
  - '@backstage/backend-defaults 0.17.8'
epss: 0.00306
epssPercentile: 0.23193
---

## Overview

Backstage is an open framework for building developer portals. Prior to 0.17.8, the @backstage/backend-defaults package is affected by improper input validation in cloud storage url readers. An attacker with write access to a cloud storage bucket used by Backstage could craft object names that could collide with protected files in the output directory. In certain deployment configurations, this could lead to content injection. This issue is fixed in version 0.17.8.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Developer Hub, Self-service automation portal 2 · no fix planned: Red Hat Developer Hub, Self-service automation portal 2 · updated 2026-10-07 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106494.json)

## Package advisory (CVE-2026-106494)

Affected packages:

- `@backstage/backend-defaults < 0.17.8`

Patched in:

- `@backstage/backend-defaults 0.17.8`

Source: https://github.com/advisories/GHSA-7649-wm97-w3j3