Improper Entity Validation in Backstage Kubernetes Plugin by Backstage
CVE-2026-106563

5.3MEDIUM

Key Information:

Vendor

Backstage

Status
Backstage
Plugin-kubernetes-backend
Vendor
CVE Published:
7 October 2026

What is CVE-2026-106563?

The vulnerability in Backstage's Kubernetes backend plugin stems from improper entity validation in a deprecated services endpoint. Authenticated users with Kubernetes read permissions can exploit this flaw to access workload data beyond their intended limits by providing maliciously crafted entity data. This situation exposes Kubernetes object metadata across configured clusters, albeit with read-only access. The issue has been resolved in version 0.21.8, emphasizing the necessity for users to upgrade and protect their systems.

Affected Version(s)

backstage < 1.54.1

plugin-kubernetes-backend < 0.21.8

References

https://github.com/backstage/backstage/security/advisorie...
x_refsource_CONFIRM
https://github.com/backstage/backstage/commit/2d5d3e77d63...
x_refsource_MISC
https://github.com/backstage/backstage/releases/tag/v1.54.1
x_refsource_MISC

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.