What’s Vulnerable › Products

backstage vulnerabilities

61 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 53 published in the last 12 months.

Check whether your backstage version is affected

Latest backstage vulnerabilities

• CVE-2026-115923 — Backstage catalog rules can be bypassed for URL locations using encoded path segments (CVSS 6.5)
• CVE-2026-106495 — Backstage: Improper access control in backend action invocation (CVSS 4.3)
• CVE-2026-106557 — Backstage: Improper input validation in TechDocs Markdown extension configuration (CVSS 7.7)
• CVE-2026-106563 — Backstage: Improper entity validation in deprecated Kubernetes services endpoint (CVSS 6.5)
• CVE-2026-106562 — Backstage: Incorrect authorization in search engine permission filtering (CVSS 4.3)
• CVE-2026-106561 — Backstage: Sensitive information disclosure in Kubernetes resource queries (CVSS 5.0)
• CVE-2026-106560 — Backstage: Improper repository path validation in a Scaffolder backend module (CVSS 6.5)
• CVE-2026-106559 — Backstage: Improper input validation in Confluence to Markdown scaffolder module (CVSS 6.5)
• CVE-2026-106558 — Backstage: Improper validation of TechDocs MkDocs configuration (CVSS 8.8)
• CVE-2026-106556 — Backstage: Configuration bypass in TechDocs mkdocs.yml sanitization (CVSS 7.7)
• CVE-2026-106510 — Backstage: Remote code execution via crafted markdown_extensions in TechDocs mkdocs.yml (CVSS 7.7)
• CVE-2026-106509 — Backstage: Improper validation of MkDocs theme configuration in TechDocs (CVSS 8.8)
• CVE-2026-106508 — Backstage: Potential file exposure through local TechDocs publisher (CVSS 6.5)
• CVE-2026-106507 — Backstage: TechDocs arbitrary file read via mkdocs snippets (CVSS 6.5)
• CVE-2026-106506 — Backstage: Improper input validation in scaffolder task list ordering (CVSS 5.3)
• CVE-2026-106505 — Backstage: Bypass of MkDocs configuration sanitizer in TechDocs backend (CVSS 8.5)
• CVE-2026-106504 — Backstage: Sensitive information exposure in scaffolder task logs (CVSS 6.5)
• CVE-2026-106503 — Backstage: Scaffolder action input authorization bypass (CVSS 8.1)
• CVE-2026-106502 — Backstage: Sensitive information may be exposed in Scaffolder task failure events (CVSS 5.3)
• CVE-2026-106501 — Backstage: Sensitive information exposure in Scaffolder (CVSS 9.6)
• CVE-2026-106500 — Backstage: Improper task state validation in Scaffolder backend (CVSS 8.5)
• CVE-2026-106499 — Backstage: Secret-derived values may be exposed in scaffolder task logs (CVSS 4.9)
• CVE-2026-106498 — Backstage: Improper URL validation in catalog entity placeholder resolution (CVSS 7.7)
• CVE-2026-106497 — Backstage: Inconsistent catalog property permission evaluation (CVSS 4.3)
• CVE-2026-106496 — Backstage: Inconsistent enforcement of allowed location types during catalog processing (CVSS 6.5)