| Package | Affected versions | Patched versions |
|---|---|---|
| backstage | < 1.54.1 | 1.54.1 |
| backstage/plugin-kubernetes-backend | < 0.21.8 | 0.21.8 |
| @backstage/plugin-kubernetes-backend | < 0.21.8 | 0.21.8 |
An authenticated user with Kubernetes read permissions could access Kubernetes workload data beyond their intended scope by supplying crafted entity data to the deprecated services endpoint. The exposure is limited to read-only access to Kubernetes object metadata across configured clusters.
Patched in @backstage/plugin-kubernetes-backend version 0.21.8.
/services/:serviceId route by deploying a custom Kubernetes router that omits it.kubernetes.resources.read permission to limit the set of users who can reach the endpoint.Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free