CVE-2026-106563

Published: Oct 7, 2026Modified: Oct 16, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

Backstage is an open framework for building developer portals. Prior to 0.21.8, the @backstage/plugin-kubernetes-backend package is affected by improper entity validation in deprecated kubernetes services endpoint. An authenticated user with Kubernetes read permissions could access Kubernetes workload data beyond their intended scope by supplying crafted entity data to the deprecated services endpoint. The exposure is limited to read-only access to Kubernetes object metadata across configured clusters. This issue is fixed in version 0.21.8.

Affected (2)

Products: Linuxfoundation: Backstage/plugin Kubernetes Backend, Backstage

Linuxfoundation

2 products

Backstage/plugin Kubernetes Backend

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Linuxfoundation Backstage/plugin Kubernetes Backend	version < 0.21.8

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Linuxfoundation Backstage	version < 1.54.1

Related CWEs

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

References (3)

https://github.com/backstage/backstage/commit/2d5d3e77d630455d6d48cfa8f31fd3c126fd6f29

Source: security-advisories@github.com

Patch

https://github.com/backstage/backstage/releases/tag/v1.54.1

Source: security-advisories@github.com

PatchRelease Notes

https://github.com/backstage/backstage/security/advisories/GHSA-r9ph-3637-55px

Source: security-advisories@github.com

MitigationVendor Advisory

Timeline

No history available yet.