All vulnerabilities
CVE-2026-106563GHSA-r9ph-3637-55px

@backstage/plugin-kubernetes-backend: Backstage: Improper entity validation in deprecated Kubernetes services endpoint

backstage @backstage/plugin-kubernetes-backendnpmContainers & cloud
Open in ThreatlineRecord JSON
CVSS
5.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.22%Chance of exploitation activity in the next 30 days, higher than 12% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in0.21.8Fixed versionGitHub
Published7 Oct 2026Updated 10 Oct 2026CVE List

What fixes it

  • 0.21.8@backstage/plugin-kubernetes-backend, npmGitHubnpm install @backstage/plugin-kubernetes-backend@0.21.8

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Impact

An authenticated user with Kubernetes read permissions could access Kubernetes workload data beyond their intended scope by supplying crafted entity data to the deprecated services endpoint. The exposure is limited to read-only access to Kubernetes object metadata across configured clusters.

Patches

Patched in @backstage/plugin-kubernetes-backend version 0.21.8.

Workarounds

  • Disable the deprecated /services/:serviceId route by deploying a custom Kubernetes router that omits it.
  • Restrict access to the kubernetes.resources.read permission to limit the set of users who can reach the endpoint.

Text from GitHub Advisory Database

Affected versions 4

  • @backstage/plugin-kubernetes-backend, npm< 0.21.8GitHub
  • backstageaffected: < 1.54.1CVE List
  • plugin-kubernetes-backendaffected: < 0.21.8CVE List
  • @backstage/plugin-kubernetes-backend, npmfrom first release, fixed in 0.21.8OSV

References 5