Backstage is an open framework for building developer portals.
CVE-2026-115923
Summary @backstage/plugin-catalog-backend matches URL-type locations against catalog.rules location patterns using the raw URL string submitted by the user, while URL readers resolve that same string in canonical form when fetching the location's content. A URL can therefore be crafted so that it appears to belong to a trusted location scope during rule evaluation, but is fetched from a different scope. Details When a deployment restricts catalog kinds to trusted URL prefixes using catalog.rules location patterns, DefaultCatalogRulesEnforcer applies glob matching directly to the raw location.target string. The URL readers used for ingestion resolve the same target in canonical form, including normalizing percent-encoded dot segments. A registered location such as https:// /trusted/%2e%2e/attacker/repo/blob/main/catalog-info.yaml matches a https:// /trusted/ pattern as a raw string, but resolves to and is fetched from https:// /attacker/repo/... when its content is read. An authenticated user with permission to register catalog locations (catalog.location.create) can use this to have an entity from an untrusted source admitted as if it originated from a trusted location scope.…
Assessment
- CVSS
- 6.5 (v3.1)
- Severity
- Medium
- EPSS
- 0.00317% chance of exploitation in the next 30 days
- Known exploited
- Not listed in CISA KEV
- Exploit availability
- Nothing found in Exploit-DB, Metasploit, Nuclei or public PoC repositories
- Published
- 26 October 2026
- Last updated
- 28 October 2026
- Affected
- npm · @backstage/plugin-catalog-backend
- Weakness
- CWE-22
- Assigner
- security-advisories@github.com
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
At the source
References
- https://github.com/backstage/backstage/commit/3214dc8f15d4a08a2fd07a72a8fe4d00aeac0db4
- https://github.com/backstage/backstage/commit/737ff1c719dbd5a97f375b7f1db6d61416618419
- https://github.com/backstage/backstage/releases/tag/v1.54.10
- https://github.com/backstage/backstage/releases/tag/v1.56.1
- https://github.com/backstage/backstage/security/advisories/GHSA-w658-mh9p-ww8f
- https://nvd.nist.gov/vuln/detail/CVE-2026-115923
- https://github.com/advisories/GHSA-w658-mh9p-ww8f
Community proofs of concept
No community proof of concept yet. If you have one for a published vulnerability and the right to share it, add it below — it will appear here once reviewed.
Submit a proof of concept
Only for publicly disclosed vulnerabilities, and only material from testing you were authorised to perform. This platform does not buy, sell, or broker exploits — see earning from vulnerability research for legitimate bounty programs. Submissions are reviewed before they appear. Text only; do not include live credentials, personal data, or anything targeting systems you are not permitted to test.
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2026-115923