CVE-2026-106458

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-106458
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-106458.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-106458
Aliases
Published
2026-10-06T20:16:12Z
Modified
2026-10-08T02:50:34Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
Backstage: Inconsistent repository filtering in Bitbucket Server catalog event updates
Details

Backstage is an open framework for building developer portals. From 0.4.0 until 0.5.15, the @backstage/plugin-catalog-backend-module-bitbucket-server package is affected by inconsistent repository filtering in bitbucket server catalog event updates. Deployments using event-driven updates in the Bitbucket Server catalog provider may ingest catalog locations from repositories that are excluded by the provider's configured project, repository, or archived-repository filters. An authenticated Bitbucket Server user who can push to a filtered-out repository that remains readable by the configured Backstage integration can trigger a legitimate repository event. The affected event path may then add a Location for that repository even though scheduled discovery excludes it. This issue is fixed in version 0.5.15.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-863"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/106xxx/CVE-2026-106458.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "0.4.0"
                },
                {
                    "fixed": "0.5.15"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/backstage/backstage

Affected ranges

Type
GIT
Repo
https://github.com/backstage/backstage
Events
Introduced
1a85f9d7b8c2ae48bc8c2386ade4f0e9e5cb157b
Fixed
989db63b6f87c8fc04d440f296ad89e10c79b363
Fixed
23161ae67d0f064e97c60c4c62b86e94c43a383e
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "1.38.0"
        },
        {
            "fixed": "1.55.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v1.*
v1.38.0
v1.39.0
v1.39.0-next.0
v1.39.0-next.1
v1.39.0-next.2
v1.39.0-next.3
v1.40.0
v1.40.0-next.0
v1.40.0-next.1
v1.40.0-next.2
v1.40.0-next.3
v1.41.0
v1.41.0-next.0
v1.41.0-next.1
v1.41.0-next.2
v1.42.0
v1.42.0-next.0
v1.42.0-next.1
v1.42.0-next.2
v1.42.0-next.3
v1.43.0
v1.43.0-next.0
v1.43.0-next.1
v1.43.0-next.2
v1.44.0
v1.44.0-next.0
v1.44.0-next.1
v1.44.0-next.2
v1.44.0-next.3
v1.45.0
v1.45.0-next.0
v1.45.0-next.1
v1.45.0-next.2
v1.45.0-next.3
v1.46.0
v1.46.0-next.0
v1.46.0-next.1
v1.46.0-next.2
v1.47.0
v1.47.0-next.0
v1.47.0-next.1
v1.47.0-next.2
v1.47.0-next.3
v1.48.0
v1.48.0-next.0
v1.48.0-next.1
v1.48.0-next.2
v1.49.0
v1.49.0-next.0
v1.49.0-next.1
v1.49.0-next.2
v1.50.0
v1.50.0-next.0
v1.50.0-next.1
v1.50.0-next.2
v1.51.0
v1.51.0-next.0
v1.51.0-next.1
v1.51.0-next.2
v1.51.0-next.3
v1.52.0
v1.52.0-next.0
v1.52.0-next.1
v1.52.0-next.2
v1.53.0
v1.53.0-next.0
v1.53.0-next.1
v1.53.0-next.2
v1.54.0
v1.54.0-next.0
v1.54.0-next.1
v1.54.0-next.2
v1.54.0-next.3
v1.55.0-next.0
v1.55.0-next.1
v1.55.0-next.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-106458.json"