@backstage vulnerabilities

Newest CVEs

• CVE-2026-106495

  Backstage: Improper access control in backend action invocation

  backstage · backstage

  Medium4.3
• CVE-2026-106557

  Backstage: Improper input validation in TechDocs Markdown extension configuration

  backstage · backstage

  High7.7
• CVE-2026-106563

  Backstage: Improper entity validation in deprecated Kubernetes services endpoint

  backstage · backstage

  Medium5.3
• CVE-2026-106562

  Backstage: Incorrect authorization in search engine permission filtering

  backstage · backstage

  Medium4.3
• CVE-2026-106561

  Backstage: Sensitive information disclosure in Kubernetes resource queries

  backstage · backstage

  Medium5.0
• CVE-2026-106560

  Backstage: Improper repository path validation in a Scaffolder backend module

  backstage · backstage

  High7.1
• CVE-2026-106559

  Backstage: Improper input validation in Confluence to Markdown scaffolder module

  backstage · backstage

  Medium6.3
• CVE-2026-106558

  Backstage: Improper validation of TechDocs MkDocs configuration

  backstage · backstage

  High8.8
• CVE-2026-106556

  Backstage: Configuration bypass in TechDocs mkdocs.yml sanitization

  backstage · backstage

  High7.7
• CVE-2026-106510

  Backstage: Remote code execution via crafted markdown_extensions in TechDocs mkdocs.yml

  backstage · backstage

  High7.7