CVE-2026-106493: Backstage: Cloud storage catalog locations may cross configured storage boundaries

October 7, 2026

Catalog entity providers for Azure Blob Storage and AWS S3 did not sufficiently validate storage object paths, which could allow catalog descriptors to be read from outside the intended storage boundary. Access is limited to locations reachable by the backend’s configured credentials.

References

github.com/advisories/GHSA-xvh9-35w9-42m4
github.com/backstage/backstage/commit/47ddbd8b4a3efd812309f759c38f4877fbd9e5ff
github.com/backstage/backstage/releases/tag/v1.54.6
github.com/backstage/backstage/security/advisories/GHSA-xvh9-35w9-42m4
nvd.nist.gov/vuln/detail/CVE-2026-106493

Code Behaviors & Features

Detect and mitigate CVE-2026-106493 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →