Vulnerabilities

TI-2026-69170 CVE-2026-106563 · GHSA-r9ph-3637-55px

Improper entity validation exposes Kubernetes data in Backstage

LOW 28

Backstage is an open framework for building developer portals.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00225 Published 2026-10-07 Partial fix · 1.54.1, 0.21.8 CWE-20

TI-2026-69169 CVE-2026-106562 · GHSA-9325-vq29-gp3v

Incorrect authorization in Backstage search permission filtering

LOW 19

Backstage is an open framework for building developer portals.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00197 Published 2026-10-07 Partial fix · 1.54.1, 2.1.6 +1 CWE-754

TI-2026-69168 CVE-2026-106561 · GHSA-p795-mqf2-36mf

Sensitive data exposure in Backstage Kubernetes resource queries

LOW 22

Backstage is an open framework for building developer portals.

CVSS 3.1MEDIUM 5.0 Network Low privileges No interaction EPSS 0.00197 Published 2026-10-07 Partial fix · 1.54.2, 0.21.9 CWE-200

TI-2026-69167 CVE-2026-106560 · GHSA-2cmg-v53w-8xfp

Path traversal in Backstage Scaffolder Confluence-to-Markdown module

LOW 31

Backstage is an open framework for building developer portals.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00314 Published 2026-10-07 Fixed in 1.54.6, 0.3.25 CWE-22

TI-2026-69166 CVE-2026-106559 · GHSA-75qf-886x-5xf2

Input validation flaw in Backstage Confluence to Markdown scaffolder

LOW 29

Backstage is an open framework for building developer portals.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00332 Published 2026-10-07 Fixed in 1.54.6, 0.3.25 CWE-22

TI-2026-69165 CVE-2026-106558 · GHSA-qmw3-745m-w99g

Backstage TechDocs config flaw allows code execution

MEDIUM 40

Backstage is an open framework for building developer portals.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00469 Published 2026-10-07 Partial fix · 1.50.7, 1.54.9 +5 CWE-502

TI-2026-69164 CVE-2026-106556

Configuration bypass in Backstage TechDocs mkdocs.yml sanitization

LOW 33

Backstage is an open framework for building developer portals.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00257 Published 2026-10-07 Partial fix · 1.50.5, 1.54.6 +2 CWE-184

TI-2026-69157 CVE-2026-106510 · GHSA-4488-j8vj-vqqv

Remote code execution in Backstage TechDocs via crafted mkdocs.yml

LOW 34

Backstage is an open framework for building developer portals.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00479 Published 2026-10-07 Partial fix · 1.50.5, 1.54.6 +2 CWE-183

TI-2026-69083 CVE-2026-106509 · GHSA-8w7q-29mw-gf5c

Code injection via MkDocs theme configuration in Backstage TechDocs

LOW 39

Backstage is an open framework for building developer portals.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00516 Published 2026-10-06 Partial fix · 1.50.5, 1.54.6 +2 CWE-1336

TI-2026-69082 CVE-2026-106508 · GHSA-cm77-ch27-6w6v

File exposure through local TechDocs publisher in Backstage

LOW 29

Backstage is an open framework for building developer portals.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00389 Published 2026-10-06 Fixed in 1.54.6, 1.15.4 CWE-22

TI-2026-69081 CVE-2026-106507

Arbitrary file read in Backstage TechDocs via mkdocs snippets

LOW 29

Backstage is an open framework for building developer portals.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00389 Published 2026-10-06 Fixed in 1.54.6, 1.15.4 CWE-59

TI-2026-69080 CVE-2026-106506 · GHSA-vwp5-f99x-x3rq

Improper input validation in Backstage scaffolder task list ordering

LOW 23

Backstage is an open framework for building developer portals.

CVSS 3.1MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00218 Published 2026-10-06 Partial fix · 1.54.6, 4.1.0 CWE-202

TI-2026-69079 CVE-2026-106505 · GHSA-p75x-jh7p-ppcx

Bypass of MkDocs config sanitizer in Backstage TechDocs backend

LOW 37

Backstage is an open framework for building developer portals.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00312 Published 2026-10-06 Partial fix · 1.50.5, 1.54.6 +2 CWE-426

TI-2026-69078 CVE-2026-106504 · GHSA-4xvq-3m68-h444

Sensitive information exposure in Backstage scaffolder task logs

LOW 28

Backstage is an open framework for building developer portals.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00257 Published 2026-10-06 Partial fix · 1.54.6, 4.1.0 CWE-532

TI-2026-69077 CVE-2026-106503 · GHSA-hmp2-4m7g-22cv

Authorization bypass in Backstage Scaffolder action inputs

LOW 38

Backstage is an open framework for building developer portals.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00492 Published 2026-10-06 Partial fix · 1.49.6, 1.50.5 +5 CWE-178

TI-2026-69076 CVE-2026-106502 · GHSA-95p4-vv4g-jxxm

Backstage Scaffolder exposes sensitive data in task failure events

LOW 24

Backstage is an open framework for building developer portals.

CVSS 3.1MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00291 Published 2026-10-06 Partial fix · 1.54.6, 4.1.0 CWE-532

TI-2026-69075 CVE-2026-106501 · GHSA-g2v8-7jhw-pp8p

Sensitive information exposure in Backstage Scaffolder

MEDIUM 43

Backstage is an open framework for building developer portals.

CVSS 3.1CRITICAL 9.6 Network Low privileges No interaction EPSS 0.00484 Published 2026-10-06 Partial fix · 1.49.6, 1.50.5 +5 CWE-200

TI-2026-69074 CVE-2026-106500 · GHSA-xvgh-hmx8-9xxf

Race condition in Backstage scaffolder backend task handling

LOW 39

Backstage is an open framework for building developer portals.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00336 Published 2026-10-06 Partial fix · 1.49.6, 1.50.5 +5 CWE-362

TI-2026-69073 CVE-2026-106499 · GHSA-mfvq-x7vr-rgqg

Secret-derived values exposed in Backstage scaffolder task logs

LOW 22

Backstage is an open framework for building developer portals.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.0027 Published 2026-10-06 Partial fix · 1.54.6, 4.1.0 CWE-532

TI-2026-69072 CVE-2026-106498 · GHSA-qgvj-qcf8-xq73

Improper URL validation in Backstage catalog entity placeholders

LOW 33

Backstage is an open framework for building developer portals.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00307 Published 2026-10-06 Partial fix · 1.49.6, 1.50.5 +8 CWE-863

TI-2026-69071 CVE-2026-106497

Backstage catalog permission flaw exposes restricted entity data

LOW 19

Backstage is an open framework for building developer portals.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00193 Published 2026-10-06 Partial fix · 1.54.6, 3.9.1 CWE-178

TI-2026-69070 CVE-2026-106496 · GHSA-pcmq-25r3-5w9v

Backstage catalog backend processes disallowed location types

LOW 28

Backstage is an open framework for building developer portals.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00244 Published 2026-10-06 Partial fix · 1.54.6, 3.9.1 CWE-22

TI-2026-69069 CVE-2026-106494 · GHSA-7649-wm97-w3j3

Improper input validation in Backstage cloud storage URL readers

LOW 22

Backstage is an open framework for building developer portals.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00306 Published 2026-10-06 Partial fix · 1.54.6, 0.17.8 CWE-22

TI-2026-69068 CVE-2026-106493 · GHSA-xvh9-35w9-42m4

Backstage cloud storage catalog reads may leave configured boundaries

LOW 19

Backstage is an open framework for building developer portals.

CVSS 3.1MEDIUM 4.1 Network High privileges No interaction EPSS 0.00276 Published 2026-10-06 Partial fix · 1.54.6, 0.17.8 +2 CWE-22

TI-2026-69067 CVE-2026-106492 · GHSA-cq7v-rfgc-5c7v

Backstage: Improper preservation of access restrictions during service credential delegation

LOW 33

Backstage is an open framework for building developer portals.

CVSS 3.1HIGH 7.6 Network Low privileges No interaction EPSS 0.00208 Published 2026-10-06 Partial fix · 1.49.6, 1.54.6 +2 CWE-269

Vulnerabilities

Filters