Description
Backstage is an open framework for building developer portals. Prior to 0.21.9, the @backstage/plugin-kubernetes-backend package is affected by sensitive information disclosure in kubernetes resource queries. An authenticated user holding the standard Kubernetes resource read permission could retrieve sensitive values that the Kubernetes plugin is designed to mask, potentially exposing credentials and other confidential material held in the connected clusters. Exposure is limited to resources that the Backstage service account is permitted to read and that match the targeted catalog entity's namespace and label selector. Deployments whose cluster credentials do not grant read access to these resources are unaffected. This issue is fixed in version 0.21.9.
Published: 2026-10-07
Score: 5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Sensitive Information Disclosure
Action: Immediate Patch
AI Analysis

Impact

The vulnerability permits an authenticated user who has standard Kubernetes read permission to retrieve data that the Backstage plugin is intended to mask, such as passwords, tokens, and other confidential material stored in Kubernetes objects. Exposure could compromise credentials and other sensitive information that an attacker would normally be prevented from seeing.

Affected Systems

Backstage installations that use the @backstage/plugin-kubernetes-backend component, specifically versions prior to 0.21.9. The impact applies to both the plugin and any Backstage deployment that incorporates it.

Risk and Exploitability

With a CVSS score of 5, the vulnerability is of moderate severity. The EPSS score is not available and it is not listed in the CISA KEV catalog. An attacker must possess authenticated access to the Backstage instance and the Kubernetes read role for the relevant namespace; once these conditions are met, they can query the plugin’s endpoint to obtain the masked data, thereby gaining direct access to sensitive cluster secrets.

Generated by OpenCVE AI on October 8, 2026 at 14:32 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the @backstage/plugin-kubernetes-backend package to version 0.21.9 or newer.
  • Restrict the Backstage service account’s Kubernetes roles to eliminate read access to secrets and other sensitive objects.
  • Verify that the Backstage instance is configured to query only the namespaces and label selectors that are explicitly required for catalog entities.

Generated by OpenCVE AI on October 8, 2026 at 14:32 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-p795-mqf2-36mf Backstage has a sensitive information disclosure in Kubernetes resource queries
History

Fri, 16 Oct 2026 15:15:00 +0000

Type Values Removed Values Added
First Time appeared Linuxfoundation
Linuxfoundation backstage
Linuxfoundation backstage\/plugin-kubernetes-backend
CPEs cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*
cpe:2.3:a:linuxfoundation:backstage\/plugin-kubernetes-backend:*:*:*:*:*:node.js:*:*
Vendors & Products Linuxfoundation
Linuxfoundation backstage
Linuxfoundation backstage\/plugin-kubernetes-backend

Sun, 11 Oct 2026 12:45:00 +0000

Type Values Removed Values Added
First Time appeared Backstage
Backstage backstage
Backstage plugin-kubernetes-backend
Vendors & Products Backstage
Backstage backstage
Backstage plugin-kubernetes-backend

Thu, 08 Oct 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-212
References
Metrics threat_severity

None

 threat_severity

Moderate

Wed, 07 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 07 Oct 2026 15:00:00 +0000

Type Values Removed Values Added
Description Backstage is an open framework for building developer portals. Prior to 0.21.9, the @backstage/plugin-kubernetes-backend package is affected by sensitive information disclosure in kubernetes resource queries. An authenticated user holding the standard Kubernetes resource read permission could retrieve sensitive values that the Kubernetes plugin is designed to mask, potentially exposing credentials and other confidential material held in the connected clusters. Exposure is limited to resources that the Backstage service account is permitted to read and that match the targeted catalog entity's namespace and label selector. Deployments whose cluster credentials do not grant read access to these resources are unaffected. This issue is fixed in version 0.21.9.
Title Backstage: Sensitive information disclosure in Kubernetes resource queries
Weaknesses CWE-200
CWE-863
References
Metrics cvssV3_1

{'score': 5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N'}

Subscriptions

Backstage Backstage Plugin-kubernetes-backend
Linuxfoundation Backstage Backstage\/plugin-kubernetes-backend
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-07T17:04:24.946Z

Reserved: 2026-10-06T20:31:59.017Z

Link: CVE-2026-106561

cve-icon Vulnrichment

Updated: 2026-10-07T15:27:00.684Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-07T15:17:17.490

Modified: 2026-10-16T14:55:13.473

Link: CVE-2026-106561

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-07T14:52:16Z

Links: CVE-2026-106561 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-11T12:28:00Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-212

    Improper Removal of Sensitive Information Before Storage or Transfer

  • CWE-863

    Incorrect Authorization