CVE-2026-106493: Backstage Path Traversal Vulnerability

CVE-2026-106493 Overview

CVE-2026-106493 is a path traversal vulnerability [CWE-22] in Backstage, the open framework for building developer portals. Versions prior to 1.54.6 fail to sufficiently validate object paths in cloud storage catalog providers. A principal with permission to create or rename objects in a configured Azure Blob Storage or AWS S3 catalog source can cause catalog descriptors to be read from outside the intended storage boundary. The read scope is limited to locations reachable with the backend's configured credentials. Backstage version 1.54.6 contains the fix.

Critical Impact
Authenticated attackers with write access to configured cloud storage catalog sources can trigger reads of catalog descriptors outside the intended storage boundary, exposing data accessible to the Backstage backend credentials.

Affected Products

Backstage versions prior to 1.54.6
Backstage deployments using Azure Blob Storage catalog providers
Backstage deployments using AWS S3 catalog providers

Discovery Timeline

2026-10-06 - CVE-2026-106493 published to NVD
2026-10-07 - Last updated in NVD database

Technical Details for CVE-2026-106493

Vulnerability Analysis

The flaw resides in the cloud storage URL readers used by Backstage's catalog subsystem. Specifically, the AwsS3UrlReader and AzureBlobStorageUrlReader modules in packages/backend-defaults/src/entrypoints/urlReader/lib/ accept object paths without strict normalization. When Backstage parses a catalog descriptor referencing another object, the resolver does not validate that the resulting path remains within the configured storage prefix. An attacker who can create or rename objects in a configured bucket or container can embed references that traverse outside the intended location. The backend then fetches those descriptors using its own credentials, returning content from storage locations the attacker should not reach.

Root Cause

The root cause is insufficient path segment validation in the cloud storage URL readers. The existing hasDotPathSegments helper rejected only dotted path segments and did not enforce that resolved URLs stayed within an expected boundary. The patch introduces isUrlPathWithoutDotSegments to strengthen validation before the backend dereferences a path.

Attack Vector

Exploitation requires a network-reachable Backstage instance and a principal with write access to a configured S3 bucket or Azure Blob container used as a catalog source. The attacker crafts object names or catalog descriptor contents that resolve, after path normalization, to locations outside the intended prefix. The Backstage backend reads those descriptors using its configured cloud credentials, returning data the attacker could not otherwise retrieve directly.

typescript

// Patch excerpt: AwsS3UrlReader.ts
 import { ReadUrlResponseFactory } from './ReadUrlResponseFactory';
 import { Readable } from 'node:stream';
 import { relative } from 'node:path/posix';
-import { hasDotPathSegments } from './util';
+import { hasDotPathSegments, isUrlPathWithoutDotSegments } from './util';

 export const DEFAULT_REGION = 'us-east-1';

// Patch excerpt: AzureBlobStorageUrlReader.ts
 import { Readable } from 'node:stream';
 import { relative } from 'node:path/posix';
 import { ReadUrlResponseFactory } from './ReadUrlResponseFactory';
-import { hasDotPathSegments } from './util';
+import { hasDotPathSegments, isUrlPathWithoutDotSegments } from './util';

Source: GitHub Commit 47ddbd8b

Detection Methods for CVE-2026-106493

Indicators of Compromise

Unexpected object names in catalog source buckets or containers containing encoded traversal sequences or dot segments.
Backstage backend fetches targeting paths outside the configured catalog prefix recorded in cloud storage access logs.
Catalog entities appearing in Backstage with descriptors not written by authorized catalog contributors.

Detection Strategies

Audit AWS S3 and Azure Blob Storage access logs for GetObject calls originating from the Backstage backend principal that target keys outside the configured catalog prefix.
Review Backstage catalog processor logs for descriptor read errors or unusual resolved paths.
Inventory all principals with write or rename permission on buckets and containers configured as Backstage catalog sources.

Monitoring Recommendations

Enable CloudTrail data events for S3 buckets and Azure Storage diagnostic logs for containers used by Backstage.
Alert on object creation events in catalog buckets by principals outside the expected contributor group.
Track Backstage version strings across environments to confirm upgrade coverage to 1.54.6 or later.

How to Mitigate CVE-2026-106493

Immediate Actions Required

Upgrade all Backstage instances to version 1.54.6 or later.
Review the IAM policy and Azure role assignments attached to the Backstage backend to minimize the blast radius of any residual path confusion.
Restrict write and rename permissions on S3 buckets and Azure Blob containers used as catalog sources to a minimal set of trusted principals.

Patch Information

The fix is published in Backstage Release v1.54.6. Technical remediation details and the complete code change are documented in GitHub Security Advisory GHSA-xvh9-35w9-42m4 and GitHub Commit 47ddbd8b.

Workarounds

Remove write and rename access for untrusted principals on cloud storage containers configured as Backstage catalog sources until the upgrade is complete.
Scope the Backstage backend's cloud credentials narrowly so that any out-of-boundary read is confined to non-sensitive storage locations.
Temporarily disable Azure Blob Storage or AWS S3 catalog providers in app-config.yaml if upgrading cannot be completed immediately.

bash

# Example: upgrade Backstage packages to the patched release
yarn add @backstage/backend-defaults@^1.54.6
yarn backstage-cli versions:bump --release 1.54.6
yarn install