Every CVE Search/ Get API key

CVE-2026-106487

Backstage: Unsupported catalog cluster authentication mode in kubernetes backend

3.5 LowFix available

Backstage is an open framework for building developer portals. Prior to 0.21.10, the @backstage/plugin-kubernetes-backend package is affected by unsupported catalog cluster authentication mode in kubernetes backend. Deployments using catalog cluster discovery may be affected when catalog contributors can create or modify kubernetes-cluster Resource entities. With the required endpoint permissions and pod RBAC, the backend can use its local in-cluster identity, potentially exposing Kubernetes resources readable by that identity. The credential is used only with the local in-cluster API endpoint and is not sent to the catalog-supplied endpoint. This issue is fixed in version 0.21.10.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
None

Exploit likelihood

0.26%Unchanged since Oct 7, 2026
90%50%10%1%

What each source reports

CVE List Score used 3.5

Backstage: Unsupported catalog cluster authentication mode in kubernetes backend

Backstage is an open framework for building developer portals. Prior to 0.21.10, the @backstage/plugin-kubernetes-backend package is affected by unsupported catalog cluster authentication mode in kubernetes backend. Deployments using catalog cluster discovery may be affected when catalog contributors can create or modify kubernetes-cluster Resource entities. With the required endpoint permissions and pod RBAC, the backend can use its local in-cluster identity, potentially exposing Kubernetes resources readable by that identity. The credential is used only with the local in-cluster API endpoint and is not sent to the catalog-supplied endpoint. This issue is fixed in version 0.21.10.

Record
CVE-2026-106487
CVSS 3.1
3.5 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N
Weakness
CWE-441
Updated
2026-11-02
EUVDEUVD-2026-94005 3.5

Backstage is an open framework for building developer portals. Prior to 0.21.10, the @backstage/plugin-kubernetes-backend package is affected by unsupported catalog cluster authentication mode in kubernetes backend. Deployments using catalog cluster discovery may be affected when catalog contributors can create or modify kubernetes-cluster Resource entities. With the required endpoint permissions and pod RBAC, the backend can use its local in-cluster identity, potentially exposing Kubernetes resources readable by that identity. The credential is used only with the local in-cluster API endpoint and is not sent to the catalog-supplied endpoint. This issue is fixed in version 0.21.10.

Record
EUVD-2026-94005
CVSS 3.1
3.5 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-h53x-hjx6-25gr 3.5

Backstage: Unsupported catalog cluster authentication mode in kubernetes backend

Impact

Deployments using catalog cluster discovery may be affected when catalog contributors can create or modify kubernetes-cluster Resource entities. With the required endpoint permissions and pod RBAC, the backend can use its local in-cluster identity, potentially exposing Kubernetes resources readable by that identity. The credential is used only with the local in-cluster API endpoint and is not sent to the catalog-supplied endpoint.

Patches

Patched in @backstage/plugin-kubernetes-backend version 0.21.10

Workarounds

  • Do not configure service account authentication through catalog-provided clusters; use the supported static configuration method when service account authentication is required.
  • Restrict catalog ingestion so untrusted users cannot create or alter Kubernetes cluster Resource entities.
Record
GHSA-h53x-hjx6-25gr
CVSS 3.1
3.5 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N
Weakness
CWE-441
Updated
2026-11-02
NVD 3.5

Backstage is an open framework for building developer portals. Prior to 0.21.10, the @backstage/plugin-kubernetes-backend package is affected by unsupported catalog cluster authentication mode in kubernetes backend. Deployments using catalog cluster discovery may be affected when catalog contributors can create or modify kubernetes-cluster Resource entities. With the required endpoint permissions and pod RBAC, the backend can use its local in-cluster identity, potentially exposing Kubernetes resources readable by that identity. The credential is used only with the local in-cluster API endpoint and is not sent to the catalog-supplied endpoint. This issue is fixed in version 0.21.10.

Record
CVE-2026-106487
CVSS 3.1
3.5 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N
CVSS 3.1
5.0 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Weakness
CWE-441
Updated
2026-11-02
OSV 3.5

Backstage: Unsupported catalog cluster authentication mode in kubernetes backend

Backstage is an open framework for building developer portals. Prior to 0.21.10, the @backstage/plugin-kubernetes-backend package is affected by unsupported catalog cluster authentication mode in kubernetes backend. Deployments using catalog cluster discovery may be affected when catalog contributors can create or modify kubernetes-cluster Resource entities. With the required endpoint permissions and pod RBAC, the backend can use its local in-cluster identity, potentially exposing Kubernetes resources readable by that identity. The credential is used only with the local in-cluster API endpoint and is not sent to the catalog-supplied endpoint. This issue is fixed in version 0.21.10.

Record
CVE-2026-106487
CVSS 3.1
3.5 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N
Weakness
CWE-441
Updated
2026-11-02
OSVGHSA-h53x-hjx6-25gr 3.5

Backstage: Unsupported catalog cluster authentication mode in kubernetes backend

Impact

Deployments using catalog cluster discovery may be affected when catalog contributors can create or modify kubernetes-cluster Resource entities. With the required endpoint permissions and pod RBAC, the backend can use its local in-cluster identity, potentially exposing Kubernetes resources readable by that identity. The credential is used only with the local in-cluster API endpoint and is not sent to the catalog-supplied endpoint.

Patches

Patched in @backstage/plugin-kubernetes-backend version 0.21.10

Workarounds

  • Do not configure service account authentication through catalog-provided clusters; use the supported static configuration method when service account authentication is required.
  • Restrict catalog ingestion so untrusted users cannot create or alter Kubernetes cluster Resource entities.
Record
GHSA-h53x-hjx6-25gr
CVSS 3.1
3.5 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N
Weakness
CWE-441
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
@backstage/plugin-kubernetes-backend
npm
 before 0.21.10
0.21.10

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-106487 is a low vulnerability (CVSS 3.5) in @backstage Plugin-kubernetes-backend, published October 6, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.26%, the 18th percentile. Fixed in @backstage/plugin-kubernetes-backend 0.21.10.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open