Backstage is an open framework for building developer portals. Prior to 0.21.8, the @backstage/plugin-kubernetes-backend package is affected by improper entity validation in deprecated kubernetes services endpoint. An authenticated user with Kubernetes read permissions could access Kubernetes workload data beyond their intended scope by supplying crafted entity data to the deprecated services endpoint. The exposure is limited to read-only access to Kubernetes object metadata across configured clusters. This issue is fixed in version 0.21.8.
References
| Link | Resource |
|---|---|
| https://github.com/backstage/backstage/commit/2d5d3e77d630455d6d48cfa8f31fd3c126fd6f29 | Patch |
| https://github.com/backstage/backstage/releases/tag/v1.54.1 | Patch Release Notes |
| https://github.com/backstage/backstage/security/advisories/GHSA-r9ph-3637-55px | Mitigation Vendor Advisory |
Configurations
History
16 Oct 2026, 14:50
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:* cpe:2.3:a:linuxfoundation:backstage\/plugin-kubernetes-backend:*:*:*:*:*:node.js:*:* |
|
| First Time |
Linuxfoundation backstage\/plugin-kubernetes-backend
Linuxfoundation backstage Linuxfoundation |
|
| References | () https://github.com/backstage/backstage/commit/2d5d3e77d630455d6d48cfa8f31fd3c126fd6f29 - Patch | |
| References | () https://github.com/backstage/backstage/releases/tag/v1.54.1 - Patch, Release Notes | |
| References | () https://github.com/backstage/backstage/security/advisories/GHSA-r9ph-3637-55px - Mitigation, Vendor Advisory |
07 Oct 2026, 15:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-10-07 15:17
Updated : 2026-10-16 14:50
NVD link : CVE-2026-106563
Mitre link : CVE-2026-106563
CVE.ORG link : CVE-2026-106563
JSON object : View
Products Affected
linuxfoundation
- backstage\/plugin-kubernetes-backend
- backstage