All vulnerabilities
CVE-2026-106493GHSA-xvh9-35w9-42m4

Backstage: Cloud storage catalog locations may cross configured storage boundaries

backstage @backstage/plugin-catalog-backend-module-azurenpmContainers & cloud
Open in ThreatlineRecord JSON
CVSS
3.0Low
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.28%Chance of exploitation activity in the next 30 days, higher than 19% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in0.3.21Also 0.4.27, 0.17.8GitHub
Published6 Oct 2026Updated 7 Oct 2026CVE List

What fixes it

  • 0.3.21@backstage/plugin-catalog-backend-module-azure, npmGitHubnpm install @backstage/plugin-catalog-backend-module-azure@0.3.21
  • 0.4.27@backstage/plugin-catalog-backend-module-aws, npmGitHubnpm install @backstage/plugin-catalog-backend-module-aws@0.4.27
  • 0.17.8@backstage/backend-defaults, npmGitHubnpm install @backstage/backend-defaults@0.17.8

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Impact

Catalog entity providers for Azure Blob Storage and AWS S3 did not sufficiently validate storage object paths, which could allow catalog descriptors to be read from outside the intended storage boundary. Access is limited to locations reachable by the backend's configured credentials.

Patches

  • @backstage/plugin-catalog-backend-module-azure version 0.3.21
  • @backstage/plugin-catalog-backend-module-aws version 0.4.27
  • @backstage/backend-defaults version 0.7.18

Workarounds

  • Restrict blob and object creation or renaming in configured catalog storage sources to trusted principals.
  • Scope Backstage's Azure and AWS reader credentials and network access to the intended storage boundaries.
  • Disable an affected catalog provider if those restrictions cannot be enforced.

Text from GitHub Advisory Database

Affected versions 10

  • @backstage/plugin-catalog-backend-module-azure, npm< 0.3.21GitHub
  • @backstage/plugin-catalog-backend-module-aws, npm< 0.4.27GitHub
  • @backstage/backend-defaults, npm< 0.17.8GitHub
  • backstageaffected: < 1.54.6CVE List
  • plugin-catalog-backend-module-azureaffected: < 0.17.8CVE List
  • plugin-catalog-backend-module-awsaffected: < 0.4.27CVE List
  • plugin-catalog-backend-module-azureaffected: < 0.3.21CVE List
  • @backstage/plugin-catalog-backend-module-azure, npmfrom first release, fixed in 0.3.21OSV
  • @backstage/plugin-catalog-backend-module-aws, npmfrom first release, fixed in 0.4.27OSV
  • @backstage/backend-defaults, npmfrom first release, fixed in 0.17.8OSV

References 5