CVE-2026-106487: Backstage: Unsupported catalog cluster authentication mode in kubernetes backend

October 7, 2026

Deployments using catalog cluster discovery may be affected when catalog contributors can create or modify kubernetes-cluster Resource entities. With the required endpoint permissions and pod RBAC, the backend can use its local in-cluster identity, potentially exposing Kubernetes resources readable by that identity. The credential is used only with the local in-cluster API endpoint and is not sent to the catalog-supplied endpoint.

References

github.com/advisories/GHSA-h53x-hjx6-25gr
github.com/backstage/backstage/commit/c14f8be6908f0f719b16356e5492352311e28946
github.com/backstage/backstage/releases/tag/v1.54.6
github.com/backstage/backstage/security/advisories/GHSA-h53x-hjx6-25gr
nvd.nist.gov/vuln/detail/CVE-2026-106487

Code Behaviors & Features

Detect and mitigate CVE-2026-106487 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →