[ CVE-2026-106493 · Published 6 Oct 2026 ]
Backstage: Cloud storage catalog locations may cross configured storage boundaries
CVSS 4.1
EPSS <1%Fix available
[ Description ]Official description
Backstage is an open framework for building developer portals. Prior to 1.54.6, cloud storage catalog providers did not sufficiently validate object paths. A principal able to create or rename objects in a configured Azure Blob Storage or AWS S3 catalog source could cause catalog descriptors to be read from outside the intended storage boundary, limited to locations reachable with the backend's configured credentials. This issue is fixed in 1.54.6.
[ Fixes ]Fixes and patches
- @backstage/plugin-catalog-backend-module-azure 0.3.21Fixed version · GitHub Advisories · npm package @backstage/plugin-catalog-backend-module-azure: upgrade to 0.3.21 or later (affected < 0.3.21)
- @backstage/plugin-catalog-backend-module-aws 0.4.27Fixed version · GitHub Advisories · npm package @backstage/plugin-catalog-backend-module-aws: upgrade to 0.4.27 or later (affected < 0.4.27)
- @backstage/backend-defaults 0.17.8Fixed version · GitHub Advisories · npm package @backstage/backend-defaults: upgrade to 0.17.8 or later (affected < 0.17.8)
- Patch on github.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD
- Patch on github.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD
[ Packages ]Affected open-source packages
- @backstage/plugin-catalog-backend-module-azure npmAffected < 0.3.21 · fixed in 0.3.21 · GHSA-xvh9-35w9-42m4
- @backstage/plugin-catalog-backend-module-aws npmAffected < 0.4.27 · fixed in 0.4.27 · GHSA-xvh9-35w9-42m4
- @backstage/backend-defaults npmAffected < 0.17.8 · fixed in 0.17.8 · GHSA-xvh9-35w9-42m4