Backstage: Cloud storage catalog locations may cross configured storage boundaries

MEDIUM 4.1CVE-2026-106493 · GHSA-xvh9-35w9-42m4 · Published 06/10/2026 · updated 22/10/2026

In short

CVE-2026-106493 is a MEDIUM (CVSS 4.1) vulnerability affecting backstage (linuxfoundation), backstage/backend-defaults (linuxfoundation), backstage/plugin-catalog-backend-module-aws (linuxfoundation).
Chance of exploitation in the next 30 days (EPSS): 0.28%, higher than 20.1% of all vulnerabilities.
Fix: update to 1.54.6, 0.17.8, 0.4.27, 0.3.21 or later.

Package	Affected versions	Patched versions
backstage linuxfoundation	`< 1.54.6`	`1.54.6`
backstage/backend-defaults linuxfoundation	`< 0.17.8`	`0.17.8`
backstage/plugin-catalog-backend-module-aws linuxfoundation	`< 0.4.27`	`0.4.27`
backstage/plugin-catalog-backend-module-azure linuxfoundation	`< 0.3.21`	`0.3.21`
@backstage/backend-defaults npm	`< 0.17.8`	`0.17.8`
@backstage/plugin-catalog-backend-module-aws npm	`< 0.4.27`	`0.4.27`
@backstage/plugin-catalog-backend-module-azure npm	`< 0.3.21`	`0.3.21`

Description

Impact

Catalog entity providers for Azure Blob Storage and AWS S3 did not sufficiently validate storage object paths, which could allow catalog descriptors to be read from outside the intended storage boundary. Access is limited to locations reachable by the backend's configured credentials.

Patches

@backstage/plugin-catalog-backend-module-azure version 0.3.21
@backstage/plugin-catalog-backend-module-aws version 0.4.27
@backstage/backend-defaults version 0.7.18

Workarounds

Restrict blob and object creation or renaming in configured catalog storage sources to trusted principals.
Scope Backstage's Azure and AWS reader credentials and network access to the intended storage boundaries.
Disable an affected catalog provider if those restrictions cannot be enforced.

NVD description

Backstage is an open framework for building developer portals. Prior to 1.54.6, cloud storage catalog providers did not sufficiently validate object paths. A principal able to create or rename objects in a configured Azure Blob Storage or AWS S3 catalog source could cause catalog descriptors to be read from outside the intended storage boundary, limited to locations reachable with the backend's configured credentials. This issue is fixed in 1.54.6.

References

backstage/backstage security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2026-106493 · ADVISORY
backstage/backstage commit 47ddbd8 · WEB
backstage/backstage · PACKAGE
backstage/backstage release v1.54.6 · WEB

More vulnerabilities in backstage

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

In short

CVE-2026-106493 is a MEDIUM (CVSS 4.1) vulnerability affecting backstage (linuxfoundation), backstage/backend-defaults (linuxfoundation), backstage/plugin-catalog-backend-module-aws (linuxfoundation).

Chance of exploitation in the next 30 days (EPSS): 0.28%, higher than 20.1% of all vulnerabilities.

Fix: update to 1.54.6, 0.17.8, 0.4.27, 0.3.21 or later.

Package

Affected versions

Patched versions

backstage

linuxfoundation

< 1.54.6

1.54.6

backstage/backend-defaults

linuxfoundation

< 0.17.8

0.17.8

backstage/plugin-catalog-backend-module-aws

linuxfoundation

< 0.4.27

0.4.27

backstage/plugin-catalog-backend-module-azure

linuxfoundation

< 0.3.21

0.3.21

@backstage/backend-defaults

npm

< 0.17.8

0.17.8

@backstage/plugin-catalog-backend-module-aws

npm

< 0.4.27

0.4.27

@backstage/plugin-catalog-backend-module-azure

npm

< 0.3.21

0.3.21

Description

Impact

Patches

@backstage/plugin-catalog-backend-module-azure version 0.3.21
@backstage/plugin-catalog-backend-module-aws version 0.4.27
@backstage/backend-defaults version 0.7.18

Workarounds

Restrict blob and object creation or renaming in configured catalog storage sources to trusted principals.
Scope Backstage's Azure and AWS reader credentials and network access to the intended storage boundaries.
Disable an affected catalog provider if those restrictions cannot be enforced.

NVD description

More vulnerabilities in backstage

See all →