CVE-2026-115923 backstage CVE debrief

Who should care

Defenders responsible for the security of Backstage deployments should assess exposure and prioritize verification of the versions in use. This includes reviewing the versions of `@backstage/plugin-catalog-backend` and applying available patches to prevent potential bypasses of catalog rules. Additionally, defenders should restrict catalog kinds to trusted URL prefixes using `catalog.rules` location patterns and monitor for authenticated users with

Why it matters

CVE-2026-115923 is a vulnerability in `@backstage/plugin-catalog-backend` that allows an authenticated user to bypass catalog rules for URL locations using encoded path segments, potentially allowing entities from untrusted sources to be admitted.

• An authenticated user with permission to register catalog locations (`catalog.location.create`) can bypass catalog rules to admit an entity from an untrusted source.
• The bypass allows an entity to be fetched from a different scope than it appears to belong to during rule evaluation.
• Defenders should verify the versions of `@backstage/plugin-catalog-backend` in use and apply available patches to prevent potential bypasses.

Technical summary

The `@backstage/plugin-catalog-backend` package is vulnerable to a bypass of catalog rules for URL locations using encoded path segments. This is caused by the package matching URL-type locations against `catalog.rules` location patterns using the raw URL string submitted by the user, while URL readers resolve that same string in canonical form when fetching the location's content. The vulnerability allows an authenticated user with permission to register catalog locations (`catalog.location.create`) to bypass catalog rules, potentially admitting entities from untrusted sources. Defenders should prioritize verifying the versions of `@backstage/plugin-catalog-backend` in use and applying available patches to

Defensive priority

Defenders should prioritize verifying the versions of `@backstage/plugin-catalog-backend` in use and applying the available patches to prevent potential bypasses of catalog rules.

Recommended defensive actions

• Verify the versions of `@backstage/plugin-catalog-backend` in use and apply available patches.
• Restrict catalog kinds to trusted URL prefixes using `catalog.rules` location patterns.
• Monitor for authenticated users with permission to register catalog locations (`catalog.location.create`).
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability is caused by the `@backstage/plugin-catalog-backend` package matching URL-type locations against `catalog.rules` location patterns using the raw URL string submitted by the user, while URL readers resolve that same string in canonical form when fetching the location's content.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.