CVE-2026-106487
Undergoing Analysis Undergoing Analysis - In Progress

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-09

Assigner: GitHub, Inc.

Description
Backstage is an open framework for building developer portals. Prior to 0.21.10, the @backstage/plugin-kubernetes-backend package is affected by unsupported catalog cluster authentication mode in kubernetes backend. Deployments using catalog cluster discovery may be affected when catalog contributors can create or modify kubernetes-cluster Resource entities. With the required endpoint permissions and pod RBAC, the backend can use its local in-cluster identity, potentially exposing Kubernetes resources readable by that identity. The credential is used only with the local in-cluster API endpoint and is not sent to the catalog-supplied endpoint. This issue is fixed in version 0.21.10.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-06
Last Modified
2026-10-09
Generated
2026-10-19
AI Q&A
2026-10-07
EPSS Evaluated
2026-10-18
NVD
CVE-2026-106487
EUVD
EUVD-2026-94005

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
backstage backstage < 1.54.6
@backstage plugin-kubernetes-backend < 0.21.10

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-441 The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere. This causes the product to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the @backstage/plugin-kubernetes-backend package in Backstage versions prior to 0.21.10. It involves unsupported catalog cluster authentication mode which may expose Kubernetes resources when catalog contributors can create or modify kubernetes-cluster Resource entities. The backend uses local in-cluster identity for API access, potentially allowing unauthorized reading of Kubernetes resources.

Detection Guidance

To detect this vulnerability, check if your Backstage instance is running a version prior to 0.21.10. Verify if the @backstage/plugin-kubernetes-backend package is installed and if catalog cluster discovery is enabled. Inspect Kubernetes cluster resource entities for unauthorized modifications.

Impact Analysis

An attacker with catalog contributor permissions could exploit this to access Kubernetes resources readable by the backend's local identity. This may lead to unauthorized data exposure or resource manipulation if RBAC permissions are misconfigured. The impact is limited to resources accessible via the local in-cluster API endpoint.

Compliance Impact

The vulnerability may expose Kubernetes resources readable by the backend's local in-cluster identity, potentially leading to unauthorized access to sensitive data. This could impact compliance with GDPR (data protection) and HIPAA (healthcare data privacy) by increasing the risk of data breaches or unauthorized disclosures.

Mitigation Strategies

Upgrade the @backstage/plugin-kubernetes-backend package to version 0.21.10 or later to address the unsupported catalog cluster authentication mode.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-106487. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart