CVE-2026-106487: Backstage Kubernetes Information Disclosure

CVE-2026-106487 Overview

CVE-2026-106487 affects the @backstage/plugin-kubernetes-backend package in Backstage, an open framework for building developer portals. Versions prior to 0.21.10 do not properly validate unsupported authentication modes when clusters are discovered through the catalog. Deployments using catalog cluster discovery are affected when contributors can create or modify kubernetes-cluster Resource entities. With the required endpoint permissions and pod RBAC, the backend can fall back to its local in-cluster identity. This behavior may expose Kubernetes resources readable by that service account identity. The issue is fixed in version 0.21.10.

Critical Impact
Catalog contributors with permission to create or modify kubernetes-cluster Resource entities may trigger the Backstage backend to query the local in-cluster Kubernetes API using its own service account identity, exposing resources readable by that identity.

Affected Products

Backstage @backstage/plugin-kubernetes-backend prior to version 0.21.10
Backstage deployments using catalog cluster discovery (CatalogClusterLocator)
Backstage release bundle v1.54.6 and earlier containing the vulnerable plugin

Discovery Timeline

2026-10-06 - CVE CVE-2026-106487 published to NVD
2026-10-07 - Last updated in NVD database

Technical Details for CVE-2026-106487

Vulnerability Analysis

The flaw resides in the CatalogClusterLocator component of the Backstage Kubernetes backend. When a kubernetes-cluster Resource entity declared the serviceAccount authentication provider, the locator logged a warning and silently discarded the entry in older behavior paths. Under affected code paths, the backend could instead proceed and use its local in-cluster identity against the local API server endpoint. The weakness is categorized under CWE-441: Unintended Proxy or Intermediary. The credential is never transmitted to the catalog-supplied endpoint, so the exposure is limited to resources readable by the backend's own pod identity.

Root Cause

The root cause is incomplete input validation on the ANNOTATION_KUBERNETES_AUTH_PROVIDER annotation when sourced from catalog entities. The locator did not reject unsupported serviceAccount auth providers with a hard error, allowing cluster definitions to flow through with incomplete authentication context. See the GitHub Security Advisory GHSA-h53x-hjx6-25gr for details.

Attack Vector

Exploitation requires a user with catalog write permissions to register or modify a kubernetes-cluster Resource entity, combined with endpoint permissions on the Backstage Kubernetes plugin and sufficient pod RBAC on the backend's service account. Attack complexity is high because multiple preconditions must align. Successful exploitation discloses Kubernetes resources that the Backstage backend's in-cluster identity is authorized to read.

typescript

// Security patch in plugins/kubernetes-backend/src/cluster-locator/CatalogClusterLocator.ts
const authProvider = annotations[ANNOTATION_KUBERNETES_AUTH_PROVIDER];
if (authProvider === 'serviceAccount') {
-  this.logger.warn(
-    `Ignoring kubernetes-cluster Resource "${name}": catalog cluster locator does not support the serviceAccount auth provider`,
+  throw new Error(
+    `Invalid cluster '${name}': authProvider 'serviceAccount' is not supported by the catalog cluster locator`,
   );
-  return undefined;
}

const apiServerUrl = annotations[ANNOTATION_KUBERNETES_API_SERVER];

Source: Backstage commit c14f8be. The patch converts the silent warning into a thrown error that aborts cluster registration when an unsupported auth provider is specified.

Detection Methods for CVE-2026-106487

Indicators of Compromise

Catalog entries of kind Resource with type: kubernetes-cluster that specify kubernetes.io/auth-provider: serviceAccount in annotations.
Backstage backend logs containing warnings about ignored kubernetes-cluster resources prior to applying the patch.
Kubernetes API audit events showing read operations from the Backstage backend service account against resources outside expected scope.

Detection Strategies

Inventory all kubernetes-cluster Resource entities in the catalog and flag those referencing the serviceAccount auth provider.
Review Backstage installation versions and confirm whether @backstage/plugin-kubernetes-backend is at 0.21.10 or later.
Correlate catalog entity creation events with subsequent Kubernetes API access patterns from the Backstage pod identity.

Monitoring Recommendations

Enable Kubernetes API audit logging for the namespace and service account used by the Backstage backend.
Monitor Backstage catalog write events for the creation or modification of kubernetes-cluster resources by non-administrative users.
Alert on unexpected get, list, or watch operations performed by the Backstage service account against sensitive resources such as secrets.

How to Mitigate CVE-2026-106487

Immediate Actions Required

Upgrade @backstage/plugin-kubernetes-backend to version 0.21.10 or later across all Backstage deployments.
Audit existing kubernetes-cluster catalog entities and remove or correct any that specify the serviceAccount auth provider.
Restrict catalog write permissions so that only trusted users can create or modify kubernetes-cluster Resource entities.

Patch Information

The fix is included in @backstage/plugin-kubernetes-backend 0.21.10 and bundled in Backstage release v1.54.6. The patch replaces the silent-ignore behavior with an explicit error when serviceAccount is used with the catalog cluster locator. Reference the security advisory GHSA-h53x-hjx6-25gr for complete remediation guidance.

Workarounds

Disable catalog-based cluster discovery and use static configuration for Kubernetes clusters until the upgrade is applied.
Apply strict RBAC to the Backstage backend's in-cluster service account, limiting it to only the namespaces and resources required for operation.
Enforce permission policies that restrict catalog.entity.create and catalog.entity.refresh for kubernetes-cluster Resource entities to administrators.

bash

# Upgrade the affected plugin to the fixed version
yarn --cwd packages/backend add @backstage/plugin-kubernetes-backend@^0.21.10

# Verify the installed version
yarn --cwd packages/backend why @backstage/plugin-kubernetes-backend