CVE-2026-106498

Summary

An authenticated Backstage user can craft catalog entities with placeholder directives that reference resources outside the entity's source repository, potentially exposing unintended data to users who should not have access to it.

Exploitability

Exploitation requires an authenticated Backstage user with catalog entity creation privileges; the attack is relatively straightforward once the user has these permissions.

Blast radius

The impact could be significant if the affected Backstage instance allows multiple teams or users to create catalog entities, potentially exposing sensitive data from other repositories or systems to unauthorized users.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 3.5.1, 3.6.2, 3.7.2, 3.8.2, or 3.9.1 of the @backstage/plugin-catalog-backend package.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.