CVE-2026-106493

mediumpriority · track · 16EPSS 0.003 · 17 %ileUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.26% (17th) EPSS

CVSS 4.1 · medium

Is it mine?

7 products

Check your exposure

Who says so?

2 sources

nvd · osv

EPSS · scored 2026-10-22

Backstage is an open framework for building developer portals. Prior to 1.54.6, cloud storage catalog providers did not sufficiently validate object paths. A principal able to create or rename objects in a configured Azure Blob Storage or AWS S3 catalog source could cause catalog descriptors to be read from outside the intended storage boundary, limited to locations reachable with the backend's configured credentials. This issue is fixed in 1.54.6.

cvss

Technical severity, 0–10. One row per scoring source.

4.1

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–medium · 2.8–4.1

v3.14.1mediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:Nprimary · NVD / NIST USexploitability 2.3 · impact 1.4

v3.13lowCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:Nsecondary · security-advisories@github.comexploitability 1.3 · impact 1.4

v3.13lowCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:Nsecondary · OSV

v3.12.8lowCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-22USCWE-22US

affected products (7)

Products and version ranges known to be affected.

linuxfoundation backstage< 1.54.6nvdUScpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*
linuxfoundation backstage/backend-defaults< 0.17.8nvdUScpe:2.3:a:linuxfoundation:backstage\/backend-defaults:*:*:*:*:*:*:*:*
linuxfoundation backstage/plugin-catalog-backend-module-aws< 0.4.27nvdUScpe:2.3:a:linuxfoundation:backstage\/plugin-catalog-backend-module-aws:*:*:*:*:*:*:*:*
linuxfoundation backstage/plugin-catalog-backend-module-azure< 0.3.21nvdUScpe:2.3:a:linuxfoundation:backstage\/plugin-catalog-backend-module-azure:*:*:*:*:*:*:*:*
npm @backstage/backend-defaults< 0.17.8osvUSpkg:npm/%40backstage/backend-defaults
npm @backstage/plugin-catalog-backend-module-aws< 0.4.27osvUSpkg:npm/%40backstage/plugin-catalog-backend-module-aws
npm @backstage/plugin-catalog-backend-module-azure< 0.3.21osvUSpkg:npm/%40backstage/plugin-catalog-backend-module-azure

advisories (1)

Vendor and ecosystem advisories describing this.

GHSA-xvh9-35w9-42m4Backstage: Cloud storage catalog locations may cross configured storage boundaries2026-10-07ghsa · osvUS
### Impact Catalog entity providers for Azure Blob Storage and AWS S3 did not sufficiently validate storage object paths, which could allow catalog descriptors to be read from outside the intended storage boundary. Access is limited to locations reachable by the backend's configured credentials. ### Patches - `@backstage/plugin-catalog-backend-module-azure` version `0.3.21` - `@backstage/plugin-catalog-backend-module-aws` version `0.4.27` - `@backstage/backend-defaults` version `0.7.18` ### Workarounds - Restrict blob and object creation or renaming in configured catalog storage sources to trusted principals. - Scope Backstage's Azure and AWS reader credentials and network access to the intended storage boundaries. - Disable an affected catalog provider if those restrictions cannot be enforced.

sources

Which sources assert this record, and when.

nvd osv NVD CVE.org MITRE

published 2026-10-06modified 2026-10-22

references (3) nvd

External citations — patches, advisories, analysis.

https://github.com/backstage/backstage/commit/47ddbd8b4a3efd812309f759c38f4877fbd9e5ffPatch
https://github.com/backstage/backstage/releases/tag/v1.54.6PatchRelease Notes
https://github.com/backstage/backstage/security/advisories/GHSA-xvh9-35w9-42m4MitigationVendor Advisory

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan