Read the docs
TI-2023-06347 Aliases CVE-2023-6944GHSA-86rg-pf4c-5grg

Rhdh: catalog-import function leaks credentials to frontend

Priority LOW 26CWE-209Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-209.

Summary

A flaw was found in the Red Hat Developer Hub (RHDH). The catalog-import function leaks GitLab access tokens on the frontend when the base64 encoded GitLab token includes a newline at the end of the string. The sanitized error can display on the frontend, including the raw access token. Upon gaining access to this token and depending on permissions, an attacker could push malicious code to repositories, delete resources in Git, revoke or generate new keys, and sign code illegitimately.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00561 46th percentileScored 2026-11-07
Fix Fixed RHDH-1.1-RHEL-9 (Red Hat): 1.1-107.1724038966@backstage/backend-app-api (npm): 0.5.9-next.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red HatRHDH-1.1-RHEL-9—1.1-107.1724038966Patch availableCNA
—@backstage/backend-app-api (npm)before 0.5.9-next.10.5.9-next.1Patch availableGHSA-86rg-pf4c-5grg
  • RHDH-1.1-RHEL-9 VendorRed Hat Affected — Fixed in 1.1-107.1724038966 Patch available CNA
  • @backstage/backend-app-api (npm) Vendor— Affected before 0.5.9-next.1 Fixed in 0.5.9-next.1 Patch available GHSA-86rg-pf4c-5grg

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:redhat:red_hat_developer_hub:*:*:*:*:*:*:*:*before 1.21.0VulnerableRed Hat
cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*before 1.21.0Vulnerablebackstage
  • cpe:2.3:a:redhat:red_hat_developer_hub:*:*:*:*:*:*:*:* Versions before 1.21.0 Vulnerable ·Red Hat
  • cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:* Versions before 1.21.0 Vulnerable ·backstage

Remediation

  • Fix · CNA RHDH-1.1-RHEL-9 (Red Hat) Fixed in 1.1-107.1724038966
  • Fix · GHSA-86rg-pf4c-5grg @backstage/backend-app-api (npm) Fixed in 0.5.9-next.1 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
RHDH 1.1 for RHEL 9Fixed—

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-6944
  2. 2026-10-03 Alias added: GHSA-86rg-pf4c-5grg

References

Advisory 4

Other 6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences