Backstage: Cloud storage catalog locations may cross configured storage boundaries
Impact
Catalog entity providers for Azure Blob Storage and AWS S3 did not sufficiently validate storage object paths, which could allow catalog descriptors to be read from outside the intended storage boundary. Access is limited to locations reachable by the backend's configured credentials.
Patches
@backstage/plugin-catalog-backend-module-azureversion0.3.21@backstage/plugin-catalog-backend-module-awsversion0.4.27@backstage/backend-defaultsversion0.7.18
Workarounds
- Restrict blob and object creation or renaming in configured catalog storage sources to trusted principals.
- Scope Backstage's Azure and AWS reader credentials and network access to the intended storage boundaries.
- Disable an affected catalog provider if those restrictions cannot be enforced.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | @backstage/backend-defaults | < 0.17.8 | 0.17.8 |
| npm package | @backstage/plugin-catalog-backend-module-aws | < 0.4.27 | 0.4.27 |
| npm package | @backstage/plugin-catalog-backend-module-azure | < 0.3.21 | 0.3.21 |
References
- https://github.com/backstage/backstage/security/advisories/GHSA-xvh9-35w9-42m4
- https://nvd.nist.gov/vuln/detail/CVE-2026-106493
- https://github.com/backstage/backstage/commit/47ddbd8b4a3efd812309f759c38f4877fbd9e5ff
- https://github.com/backstage/backstage
- https://github.com/backstage/backstage/releases/tag/v1.54.6
- CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N- Weakness (CWE)
CWE-22- Platform
- npm
- Package
@backstage/backend-defaults, @backstage/plugin-catalog-backend-module-aws, @backstage/plugin-catalog-backend-module-azure- Disclosed
- 07.10.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-xvh9-35w9-42m4 - CC BY 4.0
Vulnerability history: @backstage/backend-defaults
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 6
- First → latest
- 01.2026 10.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 2
- Medium 2
- Low 2
Disclosures per year
- 2026: 6
-
Backstage: Cloud storage catalog locations may cross configured storage boundaries this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.