An authenticated user with Kubernetes read permissions could send crafted entity data to the deprecated services endpoint in @backstage/plugin-kubernetes-backend, allowing the user to read metadata of Kubernetes workloads beyond the intended scope, resulting in confidential data exposure. The weakness is a combination of improper input validation and missing authorization controls, as reflected in CWE-20 and CWE-862.

The vulnerability affects Backstage deployments that include the @backstage/plugin-kubernetes-backend package older than version 0.21.8 and the associated backstage:backstage framework. Any installation that has this plugin enabled is susceptible if the deprecated Kubernetes services endpoint remains active. The issue is resolved as of plugin version 0.21.8, so installations using that or later are no longer impacted.

The CVSS score of 5.3 represents a moderate severity; exploit requires an authenticated user with read‑only Kubernetes rights, meaning an attacker must have legitimate access to the Backstage instance. EPSS data is not available, and the vulnerability is not listed in CISA KEV. Because the exploit path involves a known API endpoint and simple payload manipulation, the probability of exploitation remains possible in environments where the deprecated endpoint is enabled.