Backstage: Improper URL validation in catalog entity placeholder resolution
### Impact An authenticated Backstage user could craft a catalog entity with placeholder directives that reference resources outside the entity's source repository. Under certain configurations, this could allow access to data not intended to be available to the user. ### Patches Patched in `@backstage/plugin-catalog-backend` version `3.9.1` ### Workarounds If you're not able to update immediately: - Limit the scope of integration credentials (e.g., GitHub tokens) to only the repositories that Backstage needs to access.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-106498US | —OT elevated | — | ||
Backstage is an open framework for building developer portals. Prior to 3.5.1, 3.6.2, 3.7.2, 3.8.2 and 3.9.1, the @backstage/plugin-catalog-backend package is affected by improper… | ||||
references
External citations — patches, advisories, analysis.
- https://github.com/backstage/backstagePACKAGE
- https://github.com/backstage/backstage/commit/0b0f6fc89b4eb4872c76a498abbe1dc65998bb6eWEB
- https://github.com/backstage/backstage/commit/286bfc1f9cc3608a073b41016be302785be385d1WEB
- https://github.com/backstage/backstage/commit/61a10f19926aeda7f4a32de48d733e6710584634WEB
- https://github.com/backstage/backstage/commit/99729e925fd2bd40ba210022351a0ee6318e6197WEB
- https://github.com/backstage/backstage/commit/e786ac309ed2d775daf2309393c015c43902d6f6WEB
- https://github.com/backstage/backstage/releases/tag/v1.49.6WEB
- https://github.com/backstage/backstage/releases/tag/v1.50.5WEB
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan