What’s Vulnerable › Vulnerabilities

CVE-2026-106497: Backstage: Inconsistent catalog property permission evaluation

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-06 · updated 2026-10-16
• Weakness: CWE-178

Description

Backstage is an open framework for building developer portals. Prior to 3.9.1, the @backstage/plugin-catalog-backend package is affected by inconsistent catalog property permission evaluation. In deployments that use affected value-based catalog permission conditions as a confidentiality boundary, an authenticated user could receive catalog entity data that policy authors intended to restrict. This issue is fixed in version 3.9.1.

Affected products

• backstage: before 1.54.6 — fixed in 1.54.6
• Linuxfoundation Backstage Plugin-Catalog-Backend: before 3.9.1 — fixed in 3.9.1

How to fix

Upgrade to a fixed version: backstage 1.54.6; Linuxfoundation Backstage Plugin-Catalog-Backend 3.9.1. Check the vendor advisory for mitigations.

References

• https://github.com/backstage/backstage/commit/21424faa2e280a6bc6b9e5c5245952f16aafca7b
• https://github.com/backstage/backstage/releases/tag/v1.54.6
• https://github.com/backstage/backstage/security/advisories/GHSA-8429-xpcj-3cg5

Get alerted when CVE-2026-106497 or the next vulnerability affects your stack