backstage vulnerabilities

CVEs per yearBy the year they were published

1. 20216
2. 20232
3. 20246
4. 20252
5. 202653

Newest CVEs

• CVE-2026-115923

  Backstage catalog rules can be bypassed for URL locations using encoded path segments

  backstage · backstage

  Medium6.5
• CVE-2026-106495

  Backstage: Improper access control in backend action invocation

  backstage · backstage

  Medium4.3
• CVE-2026-106557

  Backstage: Improper input validation in TechDocs Markdown extension configuration

  backstage · backstage

  High7.7
• CVE-2026-106563

  Backstage: Improper entity validation in deprecated Kubernetes services endpoint

  backstage · backstage

  Medium5.3
• CVE-2026-106562

  Backstage: Incorrect authorization in search engine permission filtering

  backstage · backstage

  Medium4.3
• CVE-2026-106561

  Backstage: Sensitive information disclosure in Kubernetes resource queries

  backstage · backstage

  Medium5.0
• CVE-2026-106560

  Backstage: Improper repository path validation in a Scaffolder backend module

  backstage · backstage

  High7.1
• CVE-2026-106559

  Backstage: Improper input validation in Confluence to Markdown scaffolder module

  backstage · backstage

  Medium6.3
• CVE-2026-106558

  Backstage: Improper validation of TechDocs MkDocs configuration

  backstage · backstage

  High8.8
• CVE-2026-106556

  Backstage: Configuration bypass in TechDocs mkdocs.yml sanitization

  backstage · backstage

  High7.7