CVE-2026-106496: Backstage Path Traversal Vulnerability

CVE-2026-106496 Overview

CVE-2026-106496 affects Backstage, an open framework for building developer portals. The @backstage/plugin-catalog-backend package inconsistently enforces allowed location types during catalog processing. Under specific configurations, the catalog backend may process location types that administrators did not intend to allow. An attacker with low privileges could leverage this behavior to trigger unintended file access on the backend host. The issue is tracked under [CWE-22] (Path Traversal) and is fixed in version 3.9.1.

Critical Impact
Authenticated users may trigger the catalog backend to read files on the host that were not intended to be exposed, resulting in limited information disclosure.

Affected Products

Backstage @backstage/plugin-catalog-backend prior to 3.9.1
Backstage releases bundled before v1.54.6
Developer portals built on affected catalog-backend plugin versions

Discovery Timeline

2026-10-06 - CVE-2026-106496 published to NVD
2026-10-07 - Last updated in NVD database

Technical Details for CVE-2026-106496

Vulnerability Analysis

The Backstage catalog backend ingests entity definitions from configured locations such as URLs, Git repositories, and local files. Administrators restrict which location types are permitted using an allow-list. Before version 3.9.1, the DefaultCatalogProcessingOrchestrator did not receive the configured allowedLocationTypes set from CatalogBuilder. As a result, enforcement of the allow-list was inconsistent across the processing pipeline. A caller able to influence catalog entries could reference location types outside the intended set, including types that resolve paths on the backend host filesystem.

Root Cause

The root cause is a missing propagation of allow-list configuration between CatalogBuilder and the processing orchestrator. The orchestrator processed location references without validating them against the operator-defined allowedLocationTypes. This gap allowed location processors associated with disallowed types to execute during the normal catalog refresh cycle.

Attack Vector

Exploitation requires network access to the Backstage instance and low-privilege authenticated access to submit or influence catalog entities. The attacker crafts an entity referencing a location type that the deployment intended to disallow. The catalog backend processes the reference and reads the targeted resource on the backend host, returning content through catalog metadata. Attack complexity is high because it depends on the deployment's configuration and the specific location processors loaded.

typescript

// Patch excerpt: plugins/catalog-backend/src/processing/DefaultCatalogProcessingOrchestrator.ts
     parser: CatalogProcessorParser;
     policy: EntityPolicy;
     rulesEnforcer: CatalogRulesEnforcer;
+    allowedLocationTypes?: string[];
   };
 
   constructor(options: {

// Patch excerpt: plugins/catalog-backend/src/service/CatalogBuilder.ts
       logger,
       parser,
       policy,
+      allowedLocationTypes: this.allowedLocationType,
     });
 
     const entitiesCatalog = new AuthorizedEntitiesCatalog(

Source: GitHub Backstage Commit 23774b6

Detection Methods for CVE-2026-106496

Indicators of Compromise

Catalog entities referencing file: or other local location types that are not part of the documented allow-list.
Backend logs showing processor execution for location types outside the configured allowedLocationTypes set.
Unexpected entity metadata containing filesystem content from paths such as /etc, /proc, or application configuration directories.

Detection Strategies

Audit catalog entities for location references and compare against the catalog.locations and catalog.rules configuration.
Enable verbose logging in plugin-catalog-backend and alert on processor invocations tied to disallowed location types.
Review Git history and pull requests for new catalog-info YAML files that introduce non-standard location types.

Monitoring Recommendations

Monitor outbound filesystem read activity from the Backstage backend process and alert on access to paths outside the application working directory.
Track changes to catalog configuration and the @backstage/plugin-catalog-backend package version across deployments.
Correlate catalog refresh events with filesystem access telemetry to identify abnormal reads during processing cycles.

How to Mitigate CVE-2026-106496

Immediate Actions Required

Upgrade @backstage/plugin-catalog-backend to version 3.9.1 or later, or deploy Backstage release v1.54.6 or later.
Review and restrict catalog.locations and location type allow-lists in app-config.yaml.
Revoke write access to catalog entity sources for users who do not require it.

Patch Information

The fix is included in @backstage/plugin-catalog-backend 3.9.1 and bundled in Backstage release v1.54.6. The patch propagates allowedLocationTypes from CatalogBuilder into DefaultCatalogProcessingOrchestrator so the allow-list is enforced consistently during processing. See the GitHub Security Advisory GHSA-pcmq-25r3-5w9v and the Backstage v1.54.6 release notes.

Workarounds

Explicitly configure the catalog.rules and location type allow-list to exclude file and any other local location processors not required.
Run the Backstage backend under a dedicated service account with filesystem permissions limited to its application directory.
Place the backend inside a container or sandbox that denies read access to sensitive host paths.

bash

# Example app-config.yaml hardening: restrict location types to remote sources only
catalog:
  rules:
    - allow: [Component, API, Group, User, Resource, Location]
  locations:
    - type: url
      target: https://github.com/your-org/backstage-catalog/blob/main/catalog-info.yaml
  # Do not enable 'file' location types in production