GHSA-xvh9-35w9-42m4

Source

https://github.com/advisories/GHSA-xvh9-35w9-42m4

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-xvh9-35w9-42m4/GHSA-xvh9-35w9-42m4.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-xvh9-35w9-42m4

Aliases

CVE-2026-106493

Published

2026-10-07T17:59:55Z

Modified

2026-10-07T18:15:11Z

Severity

3.0 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N CVSS Calculator

Summary

Backstage: Cloud storage catalog locations may cross configured storage boundaries

Details

Impact

Catalog entity providers for Azure Blob Storage and AWS S3 did not sufficiently validate storage object paths, which could allow catalog descriptors to be read from outside the intended storage boundary. Access is limited to locations reachable by the backend's configured credentials.

Patches

@backstage/plugin-catalog-backend-module-azure version 0.3.21
@backstage/plugin-catalog-backend-module-aws version 0.4.27
@backstage/backend-defaults version 0.7.18

Workarounds

Restrict blob and object creation or renaming in configured catalog storage sources to trusted principals.
Scope Backstage's Azure and AWS reader credentials and network access to the intended storage boundaries.
Disable an affected catalog provider if those restrictions cannot be enforced.

Database specific

{
    "cwe_ids": [
        "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-07T17:59:55Z",
    "nvd_published_at": "2026-10-06T21:17:18Z",
    "severity": "LOW"
}

References

Affected packages

npm

@backstage/plugin-catalog-backend-module-azure

Package

Name: @backstage/plugin-catalog-backend-module-azure; View open source insights on deps.dev
Purl: pkg:npm/%40backstage/plugin-catalog-backend-module-azure

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.3.21

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-xvh9-35w9-42m4/GHSA-xvh9-35w9-42m4.json"

@backstage/plugin-catalog-backend-module-aws

Package

Name: @backstage/plugin-catalog-backend-module-aws; View open source insights on deps.dev
Purl: pkg:npm/%40backstage/plugin-catalog-backend-module-aws

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.4.27

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-xvh9-35w9-42m4/GHSA-xvh9-35w9-42m4.json"

@backstage/backend-defaults

Package

Name: @backstage/backend-defaults; View open source insights on deps.dev
Purl: pkg:npm/%40backstage/backend-defaults

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.17.8

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-xvh9-35w9-42m4/GHSA-xvh9-35w9-42m4.json"