{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-106498", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-10-06T18:46:47.766Z", "datePublished": "2026-10-06T21:23:37.560Z", "dateUpdated": "2026-10-06T21:23:37.560Z"}, "containers": {"cna": {"title": "Backstage: Improper URL validation in catalog entity placeholder resolution", "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "lang": "en", "description": "CWE-863: Incorrect Authorization", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-918", "lang": "en", "description": "CWE-918: Server-Side Request Forgery (SSRF)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/backstage/backstage/security/advisories/GHSA-qgvj-qcf8-xq73", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/backstage/backstage/security/advisories/GHSA-qgvj-qcf8-xq73"}, {"name": "https://github.com/backstage/backstage/commit/0b0f6fc89b4eb4872c76a498abbe1dc65998bb6e", "tags": ["x_refsource_MISC"], "url": "https://github.com/backstage/backstage/commit/0b0f6fc89b4eb4872c76a498abbe1dc65998bb6e"}, {"name": "https://github.com/backstage/backstage/commit/286bfc1f9cc3608a073b41016be302785be385d1", "tags": ["x_refsource_MISC"], "url": "https://github.com/backstage/backstage/commit/286bfc1f9cc3608a073b41016be302785be385d1"}, {"name": "https://github.com/backstage/backstage/commit/61a10f19926aeda7f4a32de48d733e6710584634", "tags": ["x_refsource_MISC"], "url": "https://github.com/backstage/backstage/commit/61a10f19926aeda7f4a32de48d733e6710584634"}, {"name": "https://github.com/backstage/backstage/commit/99729e925fd2bd40ba210022351a0ee6318e6197", "tags": ["x_refsource_MISC"], "url": "https://github.com/backstage/backstage/commit/99729e925fd2bd40ba210022351a0ee6318e6197"}, {"name": "https://github.com/backstage/backstage/commit/e786ac309ed2d775daf2309393c015c43902d6f6", "tags": ["x_refsource_MISC"], "url": "https://github.com/backstage/backstage/commit/e786ac309ed2d775daf2309393c015c43902d6f6"}, {"name": "https://github.com/backstage/backstage/releases/tag/v1.49.6", "tags": ["x_refsource_MISC"], "url": "https://github.com/backstage/backstage/releases/tag/v1.49.6"}, {"name": "https://github.com/backstage/backstage/releases/tag/v1.50.5", "tags": ["x_refsource_MISC"], "url": "https://github.com/backstage/backstage/releases/tag/v1.50.5"}, {"name": "https://github.com/backstage/backstage/releases/tag/v1.51.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/backstage/backstage/releases/tag/v1.51.3"}, {"name": "https://github.com/backstage/backstage/releases/tag/v1.53.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/backstage/backstage/releases/tag/v1.53.2"}, {"name": "https://github.com/backstage/backstage/releases/tag/v1.54.6", "tags": ["x_refsource_MISC"], "url": "https://github.com/backstage/backstage/releases/tag/v1.54.6"}], "affected": [{"vendor": "backstage", "product": "backstage", "versions": [{"version": "< 1.49.6", "status": "affected"}, {"version": ">= 1.50.0-next.0, < 1.50.5", "status": "affected"}, {"version": ">= 1.51.0-next.0, < 1.51.3", "status": "affected"}, {"version": ">= 1.52.0-next.0, < 1.53.2", "status": "affected"}, {"version": ">= 1.54.0-next.0, < 1.54.6", "status": "affected"}]}, {"vendor": "@backstage", "product": "plugin-catalog-backend", "versions": [{"version": "< 3.5.1", "status": "affected"}, {"version": ">= 3.6.0, < 3.6.2", "status": "affected"}, {"version": ">= 3.7.0, < 3.7.2", "status": "affected"}, {"version": ">= 3.8.0, < 3.8.2", "status": "affected"}, {"version": ">= 3.9.0, < 3.9.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-06T21:23:37.560Z"}, "descriptions": [{"lang": "en", "value": "Backstage is an open framework for building developer portals. Prior to 3.5.1, 3.6.2, 3.7.2, 3.8.2 and 3.9.1, the @backstage/plugin-catalog-backend package is affected by improper url validation in catalog entity placeholder resolution. An authenticated Backstage user could craft a catalog entity with placeholder directives that reference resources outside the entity's source repository. Under certain configurations, this could allow access to data not intended to be available to the user. This issue is fixed in versions 3.5.1, 3.6.2, 3.7.2, 3.8.2 and 3.9.1."}], "source": {"advisory": "GHSA-qgvj-qcf8-xq73", "discovery": "UNKNOWN"}}}}

{}

{"affected": [{"affectedData": [{"product": "backstage", "vendor": "backstage", "versions": [{"status": "affected", "version": "< 1.49.6"}, {"status": "affected", "version": ">= 1.50.0-next.0, < 1.50.5"}, {"status": "affected", "version": ">= 1.51.0-next.0, < 1.51.3"}, {"status": "affected", "version": ">= 1.52.0-next.0, < 1.53.2"}, {"status": "affected", "version": ">= 1.54.0-next.0, < 1.54.6"}]}, {"product": "plugin-catalog-backend", "vendor": "@backstage", "versions": [{"status": "affected", "version": "< 3.5.1"}, {"status": "affected", "version": ">= 3.6.0, < 3.6.2"}, {"status": "affected", "version": ">= 3.7.0, < 3.7.2"}, {"status": "affected", "version": ">= 3.8.0, < 3.8.2"}, {"status": "affected", "version": ">= 3.9.0, < 3.9.1"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Backstage is an open framework for building developer portals. Prior to 3.5.1, 3.6.2, 3.7.2, 3.8.2 and 3.9.1, the @backstage/plugin-catalog-backend package is affected by improper url validation in catalog entity placeholder resolution. An authenticated Backstage user could craft a catalog entity with placeholder directives that reference resources outside the entity's source repository. Under certain configurations, this could allow access to data not intended to be available to the user. This issue is fixed in versions 3.5.1, 3.6.2, 3.7.2, 3.8.2 and 3.9.1."}], "id": "CVE-2026-106498", "lastModified": "2026-10-07T13:58:29.527", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 4.0, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2026-10-06T22:17:04.713", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/backstage/backstage/commit/0b0f6fc89b4eb4872c76a498abbe1dc65998bb6e"}, {"source": "security-advisories@github.com", "url": "https://github.com/backstage/backstage/commit/286bfc1f9cc3608a073b41016be302785be385d1"}, {"source": "security-advisories@github.com", "url": "https://github.com/backstage/backstage/commit/61a10f19926aeda7f4a32de48d733e6710584634"}, {"source": "security-advisories@github.com", "url": "https://github.com/backstage/backstage/commit/99729e925fd2bd40ba210022351a0ee6318e6197"}, {"source": "security-advisories@github.com", "url": "https://github.com/backstage/backstage/commit/e786ac309ed2d775daf2309393c015c43902d6f6"}, {"source": "security-advisories@github.com", "url": "https://github.com/backstage/backstage/releases/tag/v1.49.6"}, {"source": "security-advisories@github.com", "url": "https://github.com/backstage/backstage/releases/tag/v1.50.5"}, {"source": "security-advisories@github.com", "url": "https://github.com/backstage/backstage/releases/tag/v1.51.3"}, {"source": "security-advisories@github.com", "url": "https://github.com/backstage/backstage/releases/tag/v1.53.2"}, {"source": "security-advisories@github.com", "url": "https://github.com/backstage/backstage/releases/tag/v1.54.6"}, {"source": "security-advisories@github.com", "url": "https://github.com/backstage/backstage/security/advisories/GHSA-qgvj-qcf8-xq73"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}, {"lang": "en", "value": "CWE-918"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{"bugzilla": {"description": "@backstage/plugin-catalog-backend: @backstage/plugin-catalog-backend: Information disclosure via improper URL validation in entity placeholders", "id": "2547215", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2547215"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-918", "details": ["A flaw was found in @backstage/plugin-catalog-backend. An authenticated remote user can craft a catalog entity containing placeholder directives that reference resources outside the entity's source repository due to improper URL validation. Under certain configurations, this can lead to information disclosure by allowing access to unauthorized data."], "name": "CVE-2026-106498", "package_state": [{"cpe": "cpe:/a:redhat:rhdh:1", "fix_state": "Affected", "package_name": "rhdh/rhdh-hub-rhel9", "product_name": "Red Hat Developer Hub"}, {"cpe": "cpe:/a:redhat:ansible_portal:2", "fix_state": "Affected", "package_name": "ansible-automation-platform/automation-portal", "product_name": "Self-service automation portal 2"}, {"cpe": "cpe:/a:redhat:ansible_portal:2", "fix_state": "Affected", "package_name": "ansible-automation-platform/bootc-automation-portal-rhel9", "product_name": "Self-service automation portal 2"}], "public_date": "2026-10-06T21:23:37Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-106498\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-106498\nhttps://github.com/backstage/backstage/commit/0b0f6fc89b4eb4872c76a498abbe1dc65998bb6e\nhttps://github.com/backstage/backstage/commit/286bfc1f9cc3608a073b41016be302785be385d1\nhttps://github.com/backstage/backstage/commit/61a10f19926aeda7f4a32de48d733e6710584634\nhttps://github.com/backstage/backstage/commit/99729e925fd2bd40ba210022351a0ee6318e6197\nhttps://github.com/backstage/backstage/commit/e786ac309ed2d775daf2309393c015c43902d6f6\nhttps://github.com/backstage/backstage/releases/tag/v1.49.6\nhttps://github.com/backstage/backstage/releases/tag/v1.50.5\nhttps://github.com/backstage/backstage/releases/tag/v1.51.3\nhttps://github.com/backstage/backstage/releases/tag/v1.53.2\nhttps://github.com/backstage/backstage/releases/tag/v1.54.6\nhttps://github.com/backstage/backstage/security/advisories/GHSA-qgvj-qcf8-xq73"], "statement": "This vulnerability is rated as Moderate because exploitation requires valid authenticated user access and the impact is confined to unauthorized information disclosure without enabling arbitrary command execution or system-level compromise. In products such as Red Hat Developer Hub and Red Hat Ansible Automation Platform, the catalog backend processes entity definitions within user-managed workflows, limiting unauthorized exposure to data accessible by the backend service integrations. Deployments that limit who can register or ingest new catalog entities further restrict the blast radius of this flaw.", "threat_severity": "Moderate"}

{"created": "2026-10-06T23:45:07.786897+00:00", "updated": "2026-10-06T23:45:07.786904+00:00", "vendors": []}