CVE-2026-106487
mediumpriority · track · 20EPSS 0.003 · 18 %ileUSEPSS · scored 2026-10-27
Backstage is an open framework for building developer portals. Prior to 0.21.10, the @backstage/plugin-kubernetes-backend package is affected by unsupported catalog cluster authentication mode in kubernetes backend. Deployments using catalog cluster discovery may be affected when catalog contributors can create or modify kubernetes-cluster Resource entities. With the required endpoint permissions and pod RBAC, the backend can use its local in-cluster identity, potentially exposing Kubernetes resources readable by that identity. The credential is used only with the local in-cluster API endpoint and is not sent to the catalog-supplied endpoint. This issue is fixed in version 0.21.10.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–medium · 3.5–5
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (3)
Products and version ranges known to be affected.
- linuxfoundation backstage/plugin-kubernetes-backend< 0.21.10nvdUScpe:2.3:a:linuxfoundation:backstage\/plugin-kubernetes-backend:*:*:*:*:*:*:*:*
- npm @backstage/plugin-kubernetes-backend< 0.21.10osvUSpkg:npm/%40backstage/plugin-kubernetes-backend
advisories (1)
Vendor and ecosystem advisories describing this.
- GHSA-h53x-hjx6-25grBackstage: Unsupported catalog cluster authentication mode in kubernetes backend2026-10-07ghsa · osvUS
### Impact Deployments using catalog cluster discovery may be affected when catalog contributors can create or modify `kubernetes-cluster` Resource entities. With the required endpoint permissions and pod RBAC, the backend can use its local in-cluster identity, potentially exposing Kubernetes resources readable by that identity. The credential is used only with the local in-cluster API endpoint and is not sent to the catalog-supplied endpoint. ### Patches Patched in `@backstage/plugin-kubernetes-backend` version `0.21.10` ### Workarounds - Do not configure service account authentication through catalog-provided clusters; use the supported static configuration method when service account authentication is required. - Restrict catalog ingestion so untrusted users cannot create or alter Kubernetes cluster Resource entities.
sources
Which sources assert this record, and when.
references (3) nvd
External citations — patches, advisories, analysis.
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan