CVE-2026-106458

Undergoing Analysis Undergoing Analysis - In Progress

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-07

Assigner: GitHub, Inc.

Description

Backstage is an open framework for building developer portals. From 0.4.0 until 0.5.15, the @backstage/plugin-catalog-backend-module-bitbucket-server package is affected by inconsistent repository filtering in bitbucket server catalog event updates. Deployments using event-driven updates in the Bitbucket Server catalog provider may ingest catalog locations from repositories that are excluded by the provider's configured project, repository, or archived-repository filters. An authenticated Bitbucket Server user who can push to a filtered-out repository that remains readable by the configured Backstage integration can trigger a legitimate repository event. The affected event path may then add a Location for that repository even though scheduled discovery excludes it. This issue is fixed in version 0.5.15.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-07

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-106458

Affected Vendors & Products

Vendor	Product	Version / Range
backstage	backstage	>= 1.38.0, < 1.55.0
@backstage	plugin-catalog-backend-module-bitbucket-server	>= 0.4.0, < 0.5.15

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

Backstage versions 0.4.0 to 0.5.15 have a flaw in the @backstage/plugin-catalog-backend-module-bitbucket-server package. It allows unauthorized repository locations to be added despite configured filters. An attacker with Bitbucket Server access can push to a filtered repository and trigger an event that adds it to the catalog.

Detection Guidance

Check Backstage logs for unexpected repository events from filtered-out Bitbucket Server repositories. Verify catalog locations added via event-driven updates against configured filters in @backstage/plugin-catalog-backend-module-bitbucket-server.

Impact Analysis

If exploited, this could allow unauthorized repositories to be included in your Backstage catalog. This might expose sensitive data or resources to users who should not have access. The impact depends on your specific deployment and filter configurations.

Compliance Impact

This vulnerability may lead to unauthorized access or exposure of sensitive repository data by allowing ingestion of catalog locations from excluded repositories. This could potentially violate data protection requirements under GDPR or HIPAA if sensitive information is accessed or processed without proper authorization.

Mitigation Strategies

Upgrade @backstage/plugin-catalog-backend-module-bitbucket-server to version 0.5.15 or later to fix the inconsistent repository filtering issue.

Hi! I’m here to help you understand CVE-2026-106458. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70