VendorsLinux Foundationbackstageall versions
Vulnerabilities

Linux Foundation Backstage

Ranked by severity, then by exploit likelihood, unless you sort otherwise. Click a CVE ID for its full record.

53CVEs
CVE-2026-32235
@backstage/plugin-auth-backend: OAuth redirect URI allowlist bypass
Published 2026-03-12 · Analyzed
5.9EPSS 0.002
CVE-2023-6944
Rhdh: catalog-import function leaks credentials to frontend
Published 2024-01-04 · Modified
5.7EPSS 0.006
CVE-2026-106463
Backstage: Improper authorization in GitLab organizational user ingestion
Published 2026-10-06 · Analyzed
5.4EPSS 0.002
CVE-2026-106502
Backstage: Sensitive information may be exposed in Scaffolder task failure events
Published 2026-10-06 · Analyzed
5.3EPSS 0.003
CVE-2026-106506
Backstage: Improper input validation in scaffolder task list ordering
Published 2026-10-06 · Analyzed
5.3EPSS 0.002
CVE-2026-106487
Backstage: Unsupported catalog cluster authentication mode in kubernetes backend
Published 2026-10-06 · Analyzed
5.0EPSS 0.003
CVE-2026-106561
Backstage: Sensitive information disclosure in Kubernetes resource queries
Published 2026-10-07 · Analyzed
5.0EPSS 0.002
CVE-2026-106494
Backstage: Improper input validation in cloud storage URL readers
Published 2026-10-06 · Analyzed
4.9EPSS 0.003
CVE-2026-106499
Backstage: Secret-derived values may be exposed in scaffolder task logs
Published 2026-10-06 · Analyzed
4.9EPSS 0.003
CVE-2026-106562
Backstage: Incorrect authorization in search engine permission filtering
Published 2026-10-07 · Analyzed
4.3EPSS 0.002
CVE-2026-106461
Backstage: Incorrect authorization in scaffolder task listing
Published 2026-10-06 · Analyzed
4.3EPSS 0.002
CVE-2026-106497
Backstage: Inconsistent catalog property permission evaluation
Published 2026-10-06 · Analyzed
4.3EPSS 0.002
CVE-2026-106493
Backstage: Cloud storage catalog locations may cross configured storage boundaries
Published 2026-10-06 · Analyzed
4.1EPSS 0.003
← Prev2 / 2