All vulnerabilities
CVE-2026-106498GHSA-qgvj-qcf8-xq73

@backstage/plugin-catalog-backend: Backstage: Improper URL validation in catalog entity placeholder resolution

backstage @backstage/plugin-catalog-backendnpmLibraries & packages
Open in ThreatlineRecord JSON
CVSS
7.7High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.31%Chance of exploitation activity in the next 30 days, higher than 22% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in3.9.1Fixed versionGitHub
Published6 Oct 2026Updated 9 Oct 2026CVE List

What fixes it

  • 3.9.1@backstage/plugin-catalog-backend, npmGitHubnpm install @backstage/plugin-catalog-backend@3.9.1

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Impact

An authenticated Backstage user could craft a catalog entity with placeholder directives that reference resources outside the entity's source repository. Under certain configurations, this could allow access to data not intended to be available to the user.

Patches

Patched in @backstage/plugin-catalog-backend version 3.9.1

Workarounds

If you're not able to update immediately:

  • Limit the scope of integration credentials (e.g., GitHub tokens) to only the repositories that Backstage needs to access.

Text from GitHub Advisory Database

Affected versions 12

  • @backstage/plugin-catalog-backend, npm< 3.9.1GitHub
  • backstageaffected: < 1.49.6CVE List
  • backstageaffected: >= 1.50.0-next.0, < 1.50.5CVE List
  • backstageaffected: >= 1.51.0-next.0, < 1.51.3CVE List
  • backstageaffected: >= 1.52.0-next.0, < 1.53.2CVE List
  • backstageaffected: >= 1.54.0-next.0, < 1.54.6CVE List
  • plugin-catalog-backendaffected: < 3.5.1CVE List
  • plugin-catalog-backendaffected: >= 3.6.0, < 3.6.2CVE List
  • plugin-catalog-backendaffected: >= 3.7.0, < 3.7.2CVE List
  • plugin-catalog-backendaffected: >= 3.8.0, < 3.8.2CVE List
  • plugin-catalog-backendaffected: >= 3.9.0, < 3.9.1CVE List
  • @backstage/plugin-catalog-backend, npmfrom first release, fixed in 3.9.1OSV

References 13