These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-106557 debrief based on the supplied source corpus. The CVE record was published on 2026-10-07T16:22:53.320Z and has not been modified since then. The NVD entry is currently 7.7 HIGH. This HIGH severity vulnerability in the @backstage/plugin-techdocs-node package requires verification and potential upgrades to prevent unauthorized access to resources. Defenders should assess exposure and verify v [truncated]
CVE-2026-106508 debrief based on the supplied source corpus. The CVE record was published on 2026-10-07T16:23:46.000Z and has not been modified since then. Defenders responsible for Backstage deployments using the local TechDocs publisher should assess exposure and prioritize upgrading to version 1.15.4 or switching to an external store for published TechDocs content. The local TechDocs publisher in @back [truncated]
An authenticated user with access to affected Scaffolder templates could bypass configured action restrictions. Depending on integration credentials, this could grant unauthorized access to repositories and related source-control resources. This vulnerability allows an authenticated user to bypass action restrictions in Backstage Scaffolder templates, potentially leading to unauthorized access. Defenders [truncated]
An authenticated Backstage user could craft a catalog entity with placeholder directives that reference resources outside the entity's source repository. Under certain configurations, this could allow access to data not intended to be available to the user. The vulnerability is caused by improper URL validation in catalog entity placeholder resolution in @backstage/plugin-catalog-backend. This could poten [truncated]
A vulnerability in `@backstage/backend-defaults` could allow a restricted service to perform operations beyond its intended scope. This issue is patched in version `0.17.8`. The vulnerability allows a restricted service to bypass access restrictions by routing requests through plugin delegation paths, potentially leading to write operations on plugins with read-only access. Defenders should assess exposur [truncated]
CVE-2026-106487 debrief based on the supplied source corpus. The CVE record was published on 2026-10-07T18:01:08.000Z and has not been modified since then. This vulnerability affects @backstage/plugin-kubernetes-backend versions prior to 0.21.10, where deployments using catalog cluster discovery may be impacted if catalog contributors can create or modify kubernetes-cluster Resource entities. The backend [truncated]
The CVE-2026-106460 vulnerability in the @backstage/plugin-auth-node package arises from the inconsistent handling of explicit negative email verification during shared OAuth profile normalization. This issue affects versions between 0.3.0 and 0.6.14 and between 0.7.0 and 0.7.4. An admitted identity-provider user could potentially assume another catalog identity and obtain its associated access and permis [truncated]
CVE-2026-106455: Improper validation of MkDocs plugin configuration in TechDocs allows an authenticated attacker to cause a documentation build to retrieve and publish data from network locations reachable by the build environment. Exposure depends on deployment topology, build mode, and target endpoint protections. The vulnerability affects the @backstage/plugin-techdocs-node package in versions prior to [truncated]
Backstage, an open framework for building developer portals, has a vulnerability in its experimental dynamic client registration and client ID metadata document features. The issue arises from the use of full-string matcher.isMatch glob matching for allowedRedirectUriPatterns and allowedClientIdPatterns options, which can be exploited by an attacker to obtain an OAuth authorization code. This affects depl [truncated]
A missing authorization check in Backstage's unprocessed entities endpoints allows any authenticated user to read unprocessed entity records regardless of ownership. The vulnerability exists in the @backstage/plugin-catalog-backend-module-unprocessed package prior to version 0.6.11. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, un [truncated]
CVE-2026-29186 is a high-severity configuration bypass vulnerability in the Backstage Plugin-Techdocs-Node. The vulnerability allows attackers to craft an mkdocs.yml file that causes arbitrary Python code execution, completely bypassing TechDocs' security controls. This issue has been patched in version 1.14.3. The vulnerability has a CVSS score of 7.7 and is considered high severity. The vulnerability wa [truncated]
CVE-2026-25153 is a high-severity vulnerability in the Backstage developer portal framework. The vulnerability affects @backstage/plugin-techdocs-node versions prior to 1.13.11 and 1.14.1. An attacker can exploit this vulnerability by submitting or modifying a repository's mkdocs.yml file to execute arbitrary Python code on the TechDocs build server via MkDocs hooks configuration. The fix introduces an al [truncated]
CVE-2026-24046 is a high-severity vulnerability affecting Backstage, an open framework for building developer portals. Multiple Scaffolder actions and archive extraction utilities were vulnerable to symlink-based path traversal attacks. An attacker with access to create and execute Scaffolder templates could exploit symlinks to read arbitrary files, delete arbitrary files, and write files outside the work [truncated]