backstage vulnerabilities
CVEs whose affected-version data names the backstage package (npm). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
43 CVEsRSS
CVE-2026-106488High· 8.1Backstage is an open framework for building developer portals
Backstage is an open framework for building developer portals. Prior to 0.4.20, the @backstage/plugin-auth-backend-module-oidc-provider package is affected by improper authentication in the oidc provider. Deployments using OIDC email-bas…
CVE-2026-106487Low· 3.5Backstage is an open framework for building developer portals
Backstage is an open framework for building developer portals. Prior to 0.21.10, the @backstage/plugin-kubernetes-backend package is affected by unsupported catalog cluster authentication mode in kubernetes backend. Deployments using cat…
CVE-2026-106486High· 8.5Backstage is an open framework for building developer portals
Backstage is an open framework for building developer portals. Prior to 0.3.10 in @backstage/plugin-scaffolder-backend-module-bitbucket-cloud and 0.2.25 in @backstage/plugin-scaffolder-backend-module-bitbucket-server, the Bitbucket pull-…
CVE-2026-106463Medium· 5.4Backstage is an open framework for building developer portals
Backstage is an open framework for building developer portals. Prior to 0.8.7, the @backstage/plugin-catalog-backend-module-gitlab package is affected by improper authorization in gitlab organizational user ingestion. Deployments that en…
CVE-2026-106462Medium· 6.4Backstage is an open framework for building developer portals
Backstage is an open framework for building developer portals. Prior to 1.54.6, scaffolder source-control actions may not consistently enforce intended credential boundaries. An authenticated user could cause an affected action to fall b…
CVE-2026-106461Medium· 4.3Backstage is an open framework for building developer portals
Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by incorrect authorization in scaffolder task listing. An authenticated internal user may be able…
CVE-2026-106460Medium· 6.8Backstage is an open framework for building developer portals
Backstage is an open framework for building developer portals. From 0.3.0 until 0.6.15 and 0.7.5, the @backstage/plugin-auth-node package did not consistently honor explicit negative email verification during shared OAuth profile normali…
CVE-2026-106459High· 8.5Backstage is an open framework for building developer portals
Backstage is an open framework for building developer portals. From 0.3.0 until 0.3.8, the @backstage/plugin-scaffolder-backend-module-sentry package is affected by improper input validation in sentry scaffolder actions. An authenticated…
CVE-2026-106458Medium· 6.5Backstage is an open framework for building developer portals
Backstage is an open framework for building developer portals. From 0.4.0 until 0.5.15, the @backstage/plugin-catalog-backend-module-bitbucket-server package is affected by inconsistent repository filtering in bitbucket server catalog ev…
CVE-2026-106457Medium· 6.8Backstage is an open framework for building developer portals
Backstage is an open framework for building developer portals. From 0.1.0 until 0.5.0, the @backstage/plugin-auth-backend-module-cloudflare-access-provider package is affected by insufficient audience validation in the cloudflare access …
CVE-2026-106455High· 7.7⚖ disputedBackstage is an open framework for building developer portals
Backstage is an open framework for building developer portals. From 0.11.12 until 1.14.7 and 1.15.5, the @backstage/plugin-techdocs-node package is affected by improper validation of mkdocs plugin configuration in techdocs. An authentica…
CVE-2026-88064High· 8.8Backstage is an open framework for building developer portals
Backstage is an open framework for building developer portals. Prior to 1.14.6 and from 1.15.0 until 1.15.4, the @backstage/plugin-techdocs-node package insufficiently validates mkdocs.yml supplied by an authenticated user who can regist…
CVE-2026-25153High· 7.7Backstage is an open framework for building developer portals, and @backstage/plugin-techdocs-node provides common node.js functionalities for TechDocs
Backstage is an open framework for building developer portals, and @backstage/plugin-techdocs-node provides common node.js functionalities for TechDocs. In versions of @backstage/plugin-techdocs-node prior to 1.13.11 and 1.14.1, when Tec…