The vulnerability resides in Backstage’s kubernetes backend, where an unsupported catalog cluster authentication mode allows the backend to use its local in‑cluster identity to read Kubernetes resources. This misconfiguration can expose information about cluster resources to the backend service, potentially leaking internal data to unauthorized parties. The weakness is classified as CWE-441 and CWE-478, with a CVSS score of 3.5, indicating a low severity risk of non‑critical impact.

The affected products are Backstage’s @backstage/plugin-kubernetes-backend and the Backstage core framework (backstage:backstage). Deployments using catalog cluster discovery are impacted when catalog contributors have the ability to create or modify kubernetes‑cluster resource entities. The issue exists in all versions prior to 0.21.10, which is the version that introduced the fix.

The CVSS score of 3.5 reflects that the risk is limited to potential information disclosure within the Kubernetes cluster. The EPSS score of 0.00221 indicates a very low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog, suggesting low likelihood of widespread exploitation. The vulnerability is based on missing enforcement of the supported authentication mode, leading to information disclosure and potential resource leaks in accordance with CWE-441 and CWE-478. The likely attack vector involves a catalog contributor who can create or modify cluster resources and has sufficient pod RBAC permissions; the backend can then access the cluster using its in‑cluster identity to read resources, but does not transmit credentials outside the cluster. In the absence of these conditions, the risk remains minimal.