CVE-2026-106487: Backstage: Unsupported catalog cluster authentication mode in kubernetes backend

Severity: medium (CVSS 5.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-06 · updated 2026-10-22
Weakness: CWE-441

Description

Backstage is an open framework for building developer portals. Prior to 0.21.10, the @backstage/plugin-kubernetes-backend package is affected by unsupported catalog cluster authentication mode in kubernetes backend. Deployments using catalog cluster discovery may be affected when catalog contributors can create or modify kubernetes-cluster Resource entities. With the required endpoint permissions and pod RBAC, the backend can use its local in-cluster identity, potentially exposing Kubernetes resources readable by that identity. The credential is used only with the local in-cluster API endpoint and is not sent to the catalog-supplied endpoint. This issue is fixed in version 0.21.10.

Affected products

backstage: before 1.54.6 — fixed in 1.54.6
Linuxfoundation Backstage/Plugin-Kubernetes-Backend: before 0.21.10 — fixed in 0.21.10

How to fix

Upgrade to a fixed version: backstage 1.54.6; Linuxfoundation Backstage/Plugin-Kubernetes-Backend 0.21.10. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-106487 or the next vulnerability affects your stack