CVE-2026-106496

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-106496", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-10-06T18:46:47.766Z", "datePublished": "2026-10-06T21:17:11.966Z", "dateUpdated": "2026-10-07T17:06:48.520Z"}, "containers": {"cna": {"title": "Backstage: Inconsistent enforcement of allowed location types during catalog processing", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-863", "lang": "en", "description": "CWE-863: Incorrect Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.1, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/backstage/backstage/security/advisories/GHSA-pcmq-25r3-5w9v", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/backstage/backstage/security/advisories/GHSA-pcmq-25r3-5w9v"}, {"name": "https://github.com/backstage/backstage/commit/23774b61560d851bc69cd6a77d12561b24d11afd", "tags": ["x_refsource_MISC"], "url": "https://github.com/backstage/backstage/commit/23774b61560d851bc69cd6a77d12561b24d11afd"}, {"name": "https://github.com/backstage/backstage/releases/tag/v1.54.6", "tags": ["x_refsource_MISC"], "url": "https://github.com/backstage/backstage/releases/tag/v1.54.6"}], "affected": [{"vendor": "backstage", "product": "backstage", "versions": [{"version": "< 1.54.6", "status": "affected"}]}, {"vendor": "@backstage", "product": "plugin-catalog-backend", "versions": [{"version": "< 3.9.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-06T21:17:11.966Z"}, "descriptions": [{"lang": "en", "value": "Backstage is an open framework for building developer portals. Prior to 3.9.1, the @backstage/plugin-catalog-backend package is affected by inconsistent enforcement of allowed location types during catalog processing. Under certain configurations, the catalog backend could process location types that were not intended to be allowed, potentially leading to unintended file access on the backend host. This issue is fixed in version 3.9.1."}], "source": {"advisory": "GHSA-pcmq-25r3-5w9v", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-07T15:27:09.255888Z", "id": "CVE-2026-106496", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-07T17:06:48.520Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "Backstage: Inconsistent enforcement of allowed location types during catalog processing", "source": {"advisory": "GHSA-pcmq-25r3-5w9v", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.1, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "backstage", "product": "backstage", "versions": [{"status": "affected", "version": "< 1.54.6"}]}, {"vendor": "@backstage", "product": "plugin-catalog-backend", "versions": [{"status": "affected", "version": "< 3.9.1"}]}], "references": [{"url": "https://github.com/backstage/backstage/security/advisories/GHSA-pcmq-25r3-5w9v", "name": "https://github.com/backstage/backstage/security/advisories/GHSA-pcmq-25r3-5w9v", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/backstage/backstage/commit/23774b61560d851bc69cd6a77d12561b24d11afd", "name": "https://github.com/backstage/backstage/commit/23774b61560d851bc69cd6a77d12561b24d11afd", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/backstage/backstage/releases/tag/v1.54.6", "name": "https://github.com/backstage/backstage/releases/tag/v1.54.6", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Backstage is an open framework for building developer portals. Prior to 3.9.1, the @backstage/plugin-catalog-backend package is affected by inconsistent enforcement of allowed location types during catalog processing. Under certain configurations, the catalog backend could process location types that were not intended to be allowed, potentially leading to unintended file access on the backend host. This issue is fixed in version 3.9.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863: Incorrect Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-06T21:17:11.966Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-106496", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-07T15:27:09.255888Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-10-07T15:27:10.308Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-106496", "state": "PUBLISHED", "dateUpdated": "2026-10-06T21:17:11.966Z", "dateReserved": "2026-10-06T18:46:47.766Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-10-06T21:17:11.966Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "backstage", "vendor": "backstage", "versions": [{"status": "affected", "version": "< 1.54.6"}]}, {"product": "plugin-catalog-backend", "vendor": "@backstage", "versions": [{"status": "affected", "version": "< 3.9.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:linuxfoundation:backstage_plugin-catalog-backend:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "3F9B5927-DD07-4AB5-AEF2-BECDCC9D2BF7", "versionEndExcluding": "3.9.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*", "matchCriteriaId": "630B6B8B-D515-4FEF-83C7-9CF51C7EB2F5", "versionEndExcluding": "1.54.6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Backstage is an open framework for building developer portals. Prior to 3.9.1, the @backstage/plugin-catalog-backend package is affected by inconsistent enforcement of allowed location types during catalog processing. Under certain configurations, the catalog backend could process location types that were not intended to be allowed, potentially leading to unintended file access on the backend host. This issue is fixed in version 3.9.1."}], "id": "CVE-2026-106496", "lastModified": "2026-10-16T15:33:47.510", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.1, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-106496", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-07T15:27:09.255888Z", "version": "2.0.3"}}]}, "published": "2026-10-06T22:17:04.407", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/backstage/backstage/commit/23774b61560d851bc69cd6a77d12561b24d11afd"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/backstage/backstage/releases/tag/v1.54.6"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/backstage/backstage/security/advisories/GHSA-pcmq-25r3-5w9v"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-863"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "plugin-catalog-backend: plugin-catalog-backend: Unintended file access via inconsistent location type enforcement", "id": "2547211", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2547211"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "status": "draft"}, "cwe": "CWE-552", "details": ["Backstage is an open framework for building developer portals. Prior to 3.9.1, the @backstage/plugin-catalog-backend package is affected by inconsistent enforcement of allowed location types during catalog processing. Under certain configurations, the catalog backend could process location types that were not intended to be allowed, potentially leading to unintended file access on the backend host. This issue is fixed in version 3.9.1.", "A flaw was found in the Backstage plugin-catalog-backend component. Due to inconsistent enforcement of allowed location types during catalog processing, an authenticated remote attacker can submit location targets that should be restricted under specific configurations. This flaw can enable the backend service to process unauthorized locations, potentially leading to unintended file access on the host system."], "mitigation": {"lang": "en:us", "value": "To mitigate this restrict catalog processing boundaries by confining the application's filesystem access to intended directories only and strictly audit your configuration to remove any overly permissive or untrusted location types."}, "name": "CVE-2026-106496", "package_state": [{"cpe": "cpe:/a:redhat:rhdh:1", "fix_state": "Fix deferred", "package_name": "rhdh/rhdh-hub-rhel9", "product_name": "Red Hat Developer Hub"}, {"cpe": "cpe:/a:redhat:ansible_portal:2", "fix_state": "Fix deferred", "package_name": "ansible-automation-platform/automation-portal", "product_name": "Self-service automation portal 2"}, {"cpe": "cpe:/a:redhat:ansible_portal:2", "fix_state": "Fix deferred", "package_name": "ansible-automation-platform/bootc-automation-portal-rhel9", "product_name": "Self-service automation portal 2"}], "public_date": "2026-10-06T21:17:11Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-106496\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-106496\nhttps://github.com/backstage/backstage/commit/23774b61560d851bc69cd6a77d12561b24d11afd\nhttps://github.com/backstage/backstage/releases/tag/v1.54.6\nhttps://github.com/backstage/backstage/security/advisories/GHSA-pcmq-25r3-5w9v"], "statement": "This vulnerability is rated as Low severity for Red Hat products because triggering the flaw requires an authenticated user with permissions to submit catalog locations, alongside specific configuration prerequisites. Under standard deployments of Red Hat Developer Hub and Ansible Automation Platform, location ingestion rules and catalog sources are centrally administered, substantially limiting the blast radius. As a result, the risk of unauthorized local file retrieval through catalog entity processing remains low.", "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.54.6)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "backstage", "source": "cna", "vendor": "backstage"}, "product": "backstage", "vendor": "backstage"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.9.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "plugin-catalog-backend", "source": "cna", "vendor": "@backstage"}, "product": "plugin-catalog-backend", "vendor": "backstage"}], "created": "2026-10-07T00:30:08.434426+00:00", "updated": "2026-10-09T08:31:10.208834+00:00", "vendors": ["backstage", "backstage$PRODUCT$backstage", "backstage$PRODUCT$plugin-catalog-backend"]}