CVE-2026-106487

Summary

Backstage: Unsupported catalog cluster authentication mode in kubernetes backend

Severity

low

CVSS

3.5

EPSS

0.3% (p18)

CWE

CWE-441

Also known as

GHSA-h53x-hjx6-25gr

Published

2026-10-07

Updated

2026-10-07

Advisory details

Impact

Deployments using catalog cluster discovery may be affected when catalog contributors can create or modify kubernetes-cluster Resource entities. With the required endpoint permissions and pod RBAC, the backend can use its local in-cluster identity, potentially exposing Kubernetes resources readable by that identity. The credential is used only with the local in-cluster API endpoint and is not sent to the catalog-supplied endpoint.

Patches

Patched in @backstage/plugin-kubernetes-backend version 0.21.10

Workarounds

• Do not configure service account authentication through catalog-provided clusters; use the supported static configuration method when service account authentication is required.
• Restrict catalog ingestion so untrusted users cannot create or alter Kubernetes cluster Resource entities.

References

• https://github.com/advisories/GHSA-h53x-hjx6-25gr
• https://github.com/backstage/backstage/security/advisories/GHSA-h53x-hjx6-25gr
• https://nvd.nist.gov/vuln/detail/CVE-2026-106487
• https://github.com/backstage/backstage/commit/c14f8be6908f0f719b16356e5492352311e28946
• https://github.com/backstage/backstage/releases/tag/v1.54.6

Related advisories

• CVE-2026-106563 — medium · npm/@backstage/plugin-kubernetes-backend
• CVE-2026-106561 — medium · npm/@backstage/plugin-kubernetes-backend
• CVE-2026-114125 — critical · npm/storybook
• CVE-2026-108261 — critical · npm/tinacms
• CVE-2026-107282 — critical · Maven/org.asynchttpclient:async-http-client
• CVE-2026-103922 — critical · npm/@capacitor/android
• CVE-2026-53513 — critical · npm/@better-auth/sso
• CVE-2026-101905 — high · npm/axios

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity