backstage has 20 CVEs on record. Disclosure cadence is accelerating: 19 in the last 90 days against 1 in the 90 before. The busiest recent month was October 2026 with 19. The median CVSS is 6.5 (medium). None have a confirmed exploitation report. The dominant weakness classes are CWE-22 (8) and CWE-863 (6). Most affected products: backstage (17), @backstage/plugin-proxy-backend (2), @backstage/plugin-auth-backend (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.5
- Publish → KEV
- —
- Last 90 days
- 19 prev 1
Products
- backstage 17
- @backstage/plugin-proxy-backend 2
- @backstage/plugin-auth-backend 1
Worst active — by depth score
CVE-2026-106486High· 8.5Backstage is an open framework for building developer portals47CVE-2026-106488High· 8.1Backstage is an open framework for building developer portals45CVE-2026-106557High· 7.7Backstage is an open framework for building developer portals42CVE-2026-106492High· 7.6Backstage is an open framework for building developer portals42CVE-2026-106460Medium· 6.8Backstage is an open framework for building developer portals37
backstage vulnerabilities
CVEs affecting backstage, newest first. Open any entry for full detail, references, and exploit status.
20 CVEsRSS
CVE-2026-115923Medium· 6.5Backstage catalog rules can be bypassed for URL locations using encoded path segments
Backstage is an open framework for building developer portals. Prior to 3.9.2 and from 4.0.0 until 4.0.2, DefaultCatalogRulesEnforcer in @backstage/plugin-catalog-backend compares the raw location.target URL against catalog.rules, while …
CVE-2026-106495Medium· 4.3Backstage is an open framework for building developer portals
Backstage is an open framework for building developer portals. Prior to 0.17.8, the @backstage/backend-defaults package is affected by improper access control in backend action invocation. An authenticated user could invoke actions that …
CVE-2026-106557High· 7.7Backstage is an open framework for building developer portals
Backstage is an open framework for building developer portals. Prior to 1.14.6 and 1.15.4, the @backstage/plugin-techdocs-node package did not sufficiently validate TechDocs Markdown extension configuration. An authenticated user who can…
CVE-2026-106494Medium· 4.4Backstage is an open framework for building developer portals
Backstage is an open framework for building developer portals. Prior to 0.17.8, the @backstage/backend-defaults package is affected by improper input validation in cloud storage url readers. An attacker with write access to a cloud stora…
CVE-2026-106493Low· 3.0Backstage is an open framework for building developer portals
Backstage is an open framework for building developer portals. Prior to 1.54.6, cloud storage catalog providers did not sufficiently validate object paths. A principal able to create or rename objects in a configured Azure Blob Storage o…
CVE-2026-106492High· 7.6Backstage is an open framework for building developer portals
Backstage is an open framework for building developer portals. Prior to 0.16.1 and 0.17.8, the @backstage/backend-defaults package is affected by improper preservation of access restrictions during service credential delegation. An exter…
CVE-2026-106491Medium· 6.4Backstage is an open framework for building developer portals
Backstage is an open framework for building developer portals. Prior to 0.6.17, the @backstage/plugin-proxy-backend package is affected by improper input validation in proxy-backend. An authenticated Backstage user could craft a request …
CVE-2026-106490Medium· 6.5Backstage is an open framework for building developer portals
Backstage is an open framework for building developer portals. Prior to 2.2.4, the @backstage/plugin-techdocs-backend package is affected by improper input validation in techdocs static content requests. When using the Azure Blob Storage…
CVE-2026-106489Medium· 6.5Backstage is an open framework for building developer portals
Backstage is an open framework for building developer portals. Prior to 2.2.4, the @backstage/plugin-techdocs-backend package is affected by improper authorization enforcement for techdocs static content. An authenticated user with acces…
CVE-2026-106488High· 8.1Backstage is an open framework for building developer portals
Backstage is an open framework for building developer portals. Prior to 0.4.20, the @backstage/plugin-auth-backend-module-oidc-provider package is affected by improper authentication in the oidc provider. Deployments using OIDC email-bas…
CVE-2026-106487Low· 3.5Backstage is an open framework for building developer portals
Backstage is an open framework for building developer portals. Prior to 0.21.10, the @backstage/plugin-kubernetes-backend package is affected by unsupported catalog cluster authentication mode in kubernetes backend. Deployments using cat…
CVE-2026-106486High· 8.5Backstage is an open framework for building developer portals
Backstage is an open framework for building developer portals. Prior to 0.3.10 in @backstage/plugin-scaffolder-backend-module-bitbucket-cloud and 0.2.25 in @backstage/plugin-scaffolder-backend-module-bitbucket-server, the Bitbucket pull-…
CVE-2026-106463Medium· 5.4Backstage is an open framework for building developer portals
Backstage is an open framework for building developer portals. Prior to 0.8.7, the @backstage/plugin-catalog-backend-module-gitlab package is affected by improper authorization in gitlab organizational user ingestion. Deployments that en…
CVE-2026-106462Medium· 6.4Backstage is an open framework for building developer portals
Backstage is an open framework for building developer portals. Prior to 1.54.6, scaffolder source-control actions may not consistently enforce intended credential boundaries. An authenticated user could cause an affected action to fall b…
CVE-2026-106461Medium· 4.3Backstage is an open framework for building developer portals
Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by incorrect authorization in scaffolder task listing. An authenticated internal user may be able…
CVE-2026-106460Medium· 6.8Backstage is an open framework for building developer portals
Backstage is an open framework for building developer portals. From 0.3.0 until 0.6.15 and 0.7.5, the @backstage/plugin-auth-node package did not consistently honor explicit negative email verification during shared OAuth profile normali…
CVE-2026-106458Medium· 6.5Backstage is an open framework for building developer portals
Backstage is an open framework for building developer portals. From 0.4.0 until 0.5.15, the @backstage/plugin-catalog-backend-module-bitbucket-server package is affected by inconsistent repository filtering in bitbucket server catalog ev…
CVE-2026-106457Medium· 6.8Backstage is an open framework for building developer portals
Backstage is an open framework for building developer portals. From 0.1.0 until 0.5.0, the @backstage/plugin-auth-backend-module-cloudflare-access-provider package is affected by insufficient audience validation in the cloudflare access …
CVE-2026-106456Medium· 4.8Backstage is an open framework for building developer portals
Backstage is an open framework for building developer portals. From 0.5.0 until 0.6.18, the @backstage/plugin-proxy-backend package is affected by inconsistent credential enforcement for overlapping proxy routes. An operator can configur…
GHSA-38hq-7x33-php4Medium· 4.7@backstage/plugin-auth-backend: Unauthenticated OAuth account takeover via `redirect_uri` allowlist bypass
@backstage/plugin-auth-backend: Unauthenticated OAuth account takeover via `redirect_uri` allowlist bypass