CVE-2026-106496: Backstage: Inconsistent enforcement of allowed location types during catalog processing

October 7, 2026

Under certain configurations, the catalog backend could process location types that were not intended to be allowed, potentially leading to unintended file access on the backend host.

References

github.com/advisories/GHSA-pcmq-25r3-5w9v
github.com/backstage/backstage/commit/23774b61560d851bc69cd6a77d12561b24d11afd
github.com/backstage/backstage/releases/tag/v1.54.6
github.com/backstage/backstage/security/advisories/GHSA-pcmq-25r3-5w9v
nvd.nist.gov/vuln/detail/CVE-2026-106496

Code Behaviors & Features

Detect and mitigate CVE-2026-106496 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →