CVE-2026-106494: Backstage: Improper input validation in cloud storage URL readers

October 7, 2026

An attacker with write access to a cloud storage bucket used by Backstage could craft object names that could collide with protected files in the output directory. In certain deployment configurations, this could lead to content injection.

References

github.com/advisories/GHSA-7649-wm97-w3j3
github.com/backstage/backstage/commit/14e925ce5b905dd8daa64c3009722febda76034c
github.com/backstage/backstage/releases/tag/v1.54.6
github.com/backstage/backstage/security/advisories/GHSA-7649-wm97-w3j3
nvd.nist.gov/vuln/detail/CVE-2026-106494

Code Behaviors & Features

Detect and mitigate CVE-2026-106494 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →