Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
6 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact An authenticated user could invoke actions that an operator had excluded through action configuration. Existing action permissions and downstream authorization remain enforced. Patches Patched in @backstage/backend-defaults version 0.17.8 Workarounds Limit access to action invocation endpoints to trusted service callers until upgrading.
Recommended action: Upgrade to 0.17.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Catalog entity providers for Azure Blob Storage and AWS S3 did not sufficiently validate storage object paths, which could allow catalog descriptors to be read from outside the intended storage boundary. Access is limited to locations reachable by the backend's configured credentials. Patches - @backstage/plugin-catalog-backend-module-azure version 0.3.21 - @backstage/plugin-catalog-backend-module-aws version 0.4.27 - @backstage/backend-defaults version 0.7.18 Workarounds - Restrict blob and object creation or renaming in configured catalog storage sources to trusted principals. - Scope Backstage's Azure and AWS reader credentials and network access to the intended storage boundaries. - Disable an affected catalog provider if those restrictions cannot be enforced.
Recommended action: Upgrade to 0.17.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact An external service credential configured with access restrictions (e.g., read-only) could bypass those restrictions by routing requests through plugin delegation paths. This could allow a restricted service to perform operations beyond its intended scope, including write operations on plugins it was restricted to read-only access for. Patches Patched in @backstage/backend-defaults version 0.17.8 Workarounds If you're unable to upgrade immediately: - If practical, replace restricted credentials with separate, purpose-specific unrestricted credentials scoped to trusted consumers. - Restrict network-level access to Backstage backend API endpoints to trusted callers only.
Recommended action: Upgrade to 0.17.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact An attacker with write access to a cloud storage bucket used by Backstage could craft object names that could collide with protected files in the output directory. In certain deployment configurations, this could lead to content injection. Patches Patched in @backstage/backend-defaults version 0.17.8
Recommended action: Upgrade to 0.17.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The FetchUrlReader component, used by the catalog and other plugins to fetch content from URLs, followed HTTP redirects automatically. This allowed an attacker who controls a host listed in backend.reading.allow to redirect requests to internal or sensitive URLs that are not on the allowlist, bypassing the URL allowlist security control. This is a Server-Side Request Forgery (SSRF) vulnerability that could allow access to internal resources, but it does not allow attackers to include additional request headers. Patches This vulnerability is fixed in @backstage/backend-defaults version 0.12.2, 0.13.2, 0.14.1, and 0.15.0. Users should upgrade to this version or later. Workarounds - Restrict backend.reading.allow to only trusted hosts that you control and that do not issue redirects - Ensure allowed hosts do not have open redirect vulnerabilities - Use network-level controls to block access from Backstage to sensitive internal endpoints References - OWASP SSRF Prevention Cheat…
Recommended action: Upgrade to 0.14.1, 0.13.2 or 0.12.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Multiple Scaffolder actions and archive extraction utilities were vulnerable to symlink-based path traversal attacks. An attacker with access to create and execute Scaffolder templates could exploit symlinks to: 1. Read arbitrary files via the debug:log action by creating a symlink pointing to sensitive files (e.g., /etc/passwd, configuration files, secrets) 2. Delete arbitrary files via the fs:delete action by creating symlinks pointing outside the workspace 3. Write files outside the workspace via archive extraction (tar/zip) containing malicious symlinks This affects any Backstage deployment where users can create or execute Scaffolder templates. Patches This vulnerability is fixed in the following package versions: - @backstage/backend-defaults version 0.12.2, 0.13.2, 0.14.1, 0.15.0 - @backstage/plugin-scaffolder-backend version 2.2.2, 3.0.2, 3.1.1 - @backstage/plugin-scaffolder-node version 0.11.2, 0.12.3 Users should upgrade to these versions or later. Workarounds -…
Recommended action: Upgrade to 0.14.1, 0.13.2 or 0.12.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.