What’s Vulnerable › Vulnerabilities

CVE-2026-106494: Backstage: Improper input validation in cloud storage URL readers

• Severity: medium (CVSS 4.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-06 · updated 2026-10-22
• Weakness: CWE-22

Description

Backstage is an open framework for building developer portals. Prior to 0.17.8, the @backstage/backend-defaults package is affected by improper input validation in cloud storage url readers. An attacker with write access to a cloud storage bucket used by Backstage could craft object names that could collide with protected files in the output directory. In certain deployment configurations, this could lead to content injection. This issue is fixed in version 0.17.8.

Affected products

• backstage: before 1.54.6 — fixed in 1.54.6
• Linuxfoundation Backstage/Backend Defaults: before 0.17.8 — fixed in 0.17.8

How to fix

Upgrade to a fixed version: backstage 1.54.6; Linuxfoundation Backstage/Backend Defaults 0.17.8. Check the vendor advisory for mitigations.

References

• https://github.com/backstage/backstage/commit/14e925ce5b905dd8daa64c3009722febda76034c
• https://github.com/backstage/backstage/releases/tag/v1.54.6
• https://github.com/backstage/backstage/security/advisories/GHSA-7649-wm97-w3j3

Get alerted when CVE-2026-106494 or the next vulnerability affects your stack