Vulnerability · Published Oct 6, 2026 · Assigned by GitHub_M
CVE-2026-106487Backstage: Unsupported catalog cluster authentication mode in kubernetes backend
Low 3.5
In plain English
A low-severity security flaw in backstage from backstage. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Backstage is an open framework for building developer portals. Prior to 0.21.10, the @backstage/plugin-kubernetes-backend package is affected by unsupported catalog cluster authentication mode in kubernetes backend. Deployments using catalog cluster discovery may be affected when catalog contributors can create or modify kubernetes-cluster Resource entities. With the required endpoint permissions and pod RBAC, the backend can use its local in-cluster identity, potentially exposing Kubernetes resources readable by that identity. The credential is used only with the local in-cluster API endpoint and is not sent to the catalog-supplied endpoint. This issue is fixed in version 0.21.10.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | @backstage/plugin-kubernetes-backend | 0.21.10 | GHSA-h53x-hjx6-25gr |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| backstage | backstage | < 1.54.6 |
| @backstage | plugin-kubernetes-backend | < 0.21.10 |
Weakness: CWE-441 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N