These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-106495 is a vulnerability in the @backstage/backend-defaults package, affecting Backstage versions prior to 0.17.8. An authenticated user could invoke actions that an operator had excluded through action configuration. Existing action permissions and downstream authorization remain enforced. The vulnerability is confirmed by the CVE Program and NVD. Details are provided in the source item and ref [truncated]
CVE-2026-106457 debrief based on the supplied source corpus. The CVE record was published on 2026-10-07T20:25:25.000Z and has not been modified since then. The vulnerability affects Backstage deployments using Cloudflare Access for authentication, allowing potential unauthorized authentication due to insufficient audience validation in the Cloudflare Access auth provider. Defenders should assess exposure [truncated]
CVE-2026-106456 debrief based on CVE Program and NVD records. The @backstage/plugin-proxy-backend package, used in Backstage versions 0.5.0 to 0.6.18, has inconsistent credential enforcement for overlapping proxy routes. This vulnerability allows an unauthenticated caller to potentially reach the nested upstream through Backstage, including with static upstream credentials configured for that proxy. Backs [truncated]
CVE-2026-106458 debrief: Inconsistent repository filtering in Bitbucket Server catalog event updates may allow an authenticated Bitbucket Server user to trigger a legitimate repository event, adding a Location for a filtered-out repository. This issue arises in deployments using event-driven updates in the Bitbucket Server catalog provider, where an authenticated user can push to a filtered-out repository [truncated]
CVE-2026-106459: Backstage Improper Input Validation in Sentry Scaffolder Actions. An authenticated internal user who can execute the affected actions may cause the backend to contact unintended destinations and disclose Sentry integration credentials. This vulnerability affects Backstage deployments using `@backstage/plugin-scaffolder-backend-module-sentry` versions prior to `0.3.8`. Defenders should ass [truncated]
CVE-2026-106510 is a high-severity vulnerability in the `@backstage/plugin-techdocs-node` package, allowing authenticated users to execute arbitrary OS commands on the TechDocs build host by providing a crafted `mkdocs.yml` file. The vulnerability is patched in version `1.15.4`. This vulnerability impacts users who have not upgraded to the patched version and have not applied workarounds. Defenders should [truncated]
CVE-2026-106558 debrief based on the supplied source corpus. The CVE record was published on 2026-10-07T18:03:12.000Z and has not been modified since then. This vulnerability affects Backstage deployments using @backstage/plugin-techdocs-node. An attacker who can provide configuration to a TechDocs build may execute code in the generator runtime, especially when documentation generation runs with backend [truncated]
CVE-2026-106559 Improper input validation in Confluence to Markdown scaffolder module allows attackers to influence file write operations during template execution, requiring a Backstage user to run a template processing attacker-influenced Confluence content. Patched in `@backstage/plugin-scaffolder-backend-module-confluence-to-markdown` version `0.3.25`. Defenders should assess exposure and prioritize u [truncated]
CVE-2026-106560 debrief based on the supplied source corpus. The CVE record was published on 2026-10-07T18:02:59.000Z and has not been modified since then. This vulnerability affects the Backstage Scaffolder backend module, allowing authenticated users to write generated content outside the task workspace. Defenders should assess exposure and prioritize upgrading to version 0.3.25 or later. The vulnerabil [truncated]
CVE-2026-106562 debrief based on the supplied source corpus. The CVE record was published on 2026-10-07T18:02:52.000Z and has not been modified since then. This vulnerability affects Backstage deployments with permission.enabled: true and an Elasticsearch or OpenSearch search backend. An authenticated user subject to a DENY policy for search document types could receive search results they were not author [truncated]
CVE-2026-106563 is a vulnerability in the `@backstage/plugin-kubernetes-backend` package that allows authenticated users with Kubernetes read permissions to access Kubernetes workload data beyond their intended scope. The exposure is limited to read-only access to Kubernetes object metadata across configured clusters. Defenders should prioritize verifying exposure and restricting access to the deprecated [truncated]
CVE-2026-106561 debrief based on the supplied source corpus. The CVE record was published on 2026-10-07T18:02:30.000Z and has not been modified since then. The NVD entry is currently MEDIUM. The Backstage Kubernetes plugin has a sensitive information disclosure vulnerability. An authenticated user with standard Kubernetes resource read permission could retrieve sensitive values that the plugin is designed [truncated]
CVE-2026-106462 debrief based on the supplied source corpus. The CVE record was published on 2026-10-07T18:01:53.000Z and has not been modified since then. The NVD entry is currently unclassified. Defenders responsible for Backstage deployments, specifically those using Scaffolder actions that interact with source control systems, should assess exposure and prioritize verification and remediation. The vul [truncated]
CVE-2026-106463 debrief based on the supplied source corpus. Deployments that enable GitLab organization event ingestion and rely on scoped catalog users as an access boundary may admit an unintended catalog identity. This could potentially allow unauthorized access with standard authenticated user permissions depending on sign-in and permission configuration. Defenders should assess exposure and prioriti [truncated]
CVE-2026-106486 debrief based on the supplied source corpus. The CVE record was published on 2026-10-07T18:01:26.000Z and has not been modified since then. The vulnerability affects the Backstage plugin for Bitbucket pull-request scaffolder actions, allowing an authenticated user to affect filesystem paths outside the expected working area, potentially compromising backend confidentiality, integrity, or a [truncated]
CVE-2026-106488 debrief: Backstage OIDC provider improper authentication allows potential identity assumption and access escalation in deployments using OIDC email-based identity resolution with a provider that permits unverified email addresses. This may grant access and permissions associated with that user. No direct availability impact is demonstrated. The issue is patched in @backstage/plugin-auth-ba [truncated]
An authenticated user with access to one TechDocs documentation site could craft a URL able to read documentation belonging to a different entity. This only affects deployments using the external TechDocs builder with an external storage provider (S3, GCS, etc.) and the permission framework enabled. The vulnerability allows an attacker to access documentation from a different entity by manipulating the UR [truncated]
CVE-2026-106490: Backstage Improper Input Validation in TechDocs Static Content Requests. The @backstage/plugin-techdocs-backend package is vulnerable to improper input validation when using Azure Blob Storage with entity-level permissions enabled. This allows authenticated users to read restricted TechDocs content. The vulnerability was patched in version 2.2.4. Backstage administrators and users with ac [truncated]
PatchSiren debrief for CVE-2026-106493: Backstage cloud storage catalog locations may cross configured storage boundaries. This vulnerability impacts deployments using Azure Blob Storage and AWS S3, allowing catalog descriptors to be read from outside intended storage boundaries. Access is limited to locations reachable by the backend's configured credentials. Defenders should assess exposure and prioriti [truncated]
CVE-2026-106491 Backstage Improper input validation in proxy-backend debrief. The vulnerability allows an authenticated Backstage user to craft a request URL that causes the proxy-backend to forward the request to a path outside the configured base path on the target server. This is limited to target servers already configured as proxy endpoints and requires Backstage authentication by default. Patched in [truncated]
CVE-2026-106494 debrief based on the supplied source corpus. The CVE record was published on 2026-10-07T17:59:38.000Z. Backstage, a software development platform, has a vulnerability in its cloud storage URL readers due to improper input validation. This could lead to content injection in certain deployment configurations if an attacker with write access to a cloud storage bucket crafts object names that [truncated]
The @backstage/plugin-catalog-backend package prior to version 3.9.1 is affected by inconsistent enforcement of allowed location types during catalog processing. This could potentially lead to unintended file access on the backend host. Defenders responsible for Backstage deployments, especially those using @backstage/plugin-catalog-backend versions prior to 3.9.1, should assess exposure and verify the ne [truncated]
An authenticated Backstage user who can read another user's Scaffolder task may receive internal execution data. In deployments where that data contains credentials for an external service, this may permit disclosure and unauthorized changes in that external service. Defenders responsible for Backstage deployments, particularly those using Scaffolder, should assess exposure and prioritize remediation to p [truncated]
A vulnerability in `@backstage/plugin-scaffolder-backend` allows sensitive values to be exposed in task logs if an attacker can create or modify Scaffolder templates. The issue is patched in version `4.1.0`. This vulnerability affects deployments that configure sensitive `scaffolder.defaultEnvironment.secrets` and allow an attacker to create or modify Scaffolder templates. A template author could cause se [truncated]
CVE-2026-106500 Improper task state validation in Scaffolder backend affects Backstage. Authenticated users with Scaffolder task permissions may affect backend files under specific conditions, potentially compromising confidentiality, integrity, and availability. Patched in `@backstage/plugin-scaffolder-backend` version `4.1.0`. This vulnerability impacts Backstage deployments with Scaffolder tasks, allow [truncated]
CVE-2026-106502 debrief based on the supplied source corpus. The CVE record was published on 2026-10-07T16:24:51.000Z and has not been modified since then. This vulnerability exists in `@backstage/plugin-scaffolder-backend` versions prior to 4.1.0. Under specific template and failure conditions, an authenticated user may be able to retrieve sensitive values from Scaffolder task events, potentially exposin [truncated]
CVE-2026-106504 debrief based on the supplied source corpus. The vulnerability is a sensitive information exposure in Backstage deployments using `@backstage/plugin-scaffolder-backend` versions before 4.1.0. An authenticated user who can create and read scaffolder tasks may observe sensitive values in task logs. This exposure requires a denied action whose input contains such a value. Defenders should ass [truncated]
CVE-2026-106506: Improper input validation in Backstage plugin-scaffolder-backend allows authenticated users to infer confidential task data under specific conditions. The issue is fixed in version 4.1.0. This vulnerability affects Backstage users with scaffolder task permissions, who should assess their exposure and prioritize updating to version 4.1.0 or later. The vulnerability has a medium severity an [truncated]
CVE-2026-106505: Backstage TechDocs backend vulnerable to MkDocs configuration sanitizer bypass. The vulnerability allows users with repository write access to execute arbitrary code on the TechDocs backend host during documentation generation. Defenders should assess exposure and prioritize remediation by upgrading @backstage/plugin-techdocs-node to version 1.15.4 or later, restricting repository write a [truncated]
CVE-2026-106509 is a high-severity vulnerability affecting the @backstage/plugin-techdocs-node package. It allows for arbitrary code execution during the documentation build process when TechDocs is configured to build documentation locally or in a container. Users with write access to a registered repository can include configuration values in mkdocs.yml that cause the issue. The vulnerability is fixed i [truncated]
