CVE-2026-106487 backstage CVE debrief

Who should care

Defenders responsible for Backstage deployments using catalog cluster discovery should assess exposure, especially where untrusted users can create or modify Kubernetes cluster Resource entities. They should verify if their deployment is affected and take necessary actions to secure it.

Why it matters

CVE-2026-106487 is a vulnerability in @backstage/plugin-kubernetes-backend that can lead to potential exposure of Kubernetes resources. Defenders should verify exposure, especially in deployments using catalog cluster discovery, and take necessary actions to secure their environments.

• Potential exposure of Kubernetes resources readable by the backend's local in-cluster identity.
• Need to verify and restrict catalog ingestion to prevent unauthorized modifications.
• Requirement to update @backstage/plugin-kubernetes-backend to version 0.21.10 or later.
• Possible impact on service account authentication configurations.

Technical summary

The @backstage/plugin-kubernetes-backend package prior to version 0.21.10 has a vulnerability in its catalog cluster authentication mode. Deployments using catalog cluster discovery may be affected when catalog contributors can create or modify kubernetes-cluster Resource entities. The backend can use its local in-cluster identity, potentially exposing Kubernetes resources readable by that identity.

Defensive priority

Defenders should prioritize verifying exposure in Backstage deployments using catalog cluster discovery, especially where untrusted users can create or modify Kubernetes cluster Resource entities.

Recommended defensive actions

• Verify if your Backstage deployment uses catalog cluster discovery and if untrusted users can create or modify Kubernetes cluster Resource entities.
• Restrict catalog ingestion to prevent untrusted users from creating or altering Kubernetes cluster Resource entities.
• Use the supported static configuration method for service account authentication when required.
• Update @backstage/plugin-kubernetes-backend to version 0.21.10 or later.
• Monitor for suspicious activity related to Kubernetes resources readable by the backend's local in-cluster identity.

Evidence notes

The source corpus provides details on the vulnerability in @backstage/plugin-kubernetes-backend versions prior to 0.21.10, where deployments using catalog cluster discovery may be affected if catalog contributors can create or modify kubernetes-cluster Resource entities.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.