CVE-2026-115923: Backstage catalog rules can be bypassed for URL locations using encoded path segments
@backstage/plugin-catalog-backend matches URL-type locations against catalog.rules location patterns using the raw URL string submitted by the user, while URL readers resolve that same string in canonical form when fetching the location’s content. A URL can therefore be crafted so that it appears to belong to a trusted location scope during rule evaluation, but is fetched from a different scope.
References
- github.com/advisories/GHSA-w658-mh9p-ww8f
- github.com/backstage/backstage/commit/3214dc8f15d4a08a2fd07a72a8fe4d00aeac0db4
- github.com/backstage/backstage/commit/737ff1c719dbd5a97f375b7f1db6d61416618419
- github.com/backstage/backstage/releases/tag/v1.54.10
- github.com/backstage/backstage/releases/tag/v1.56.1
- github.com/backstage/backstage/security/advisories/GHSA-w658-mh9p-ww8f
- nvd.nist.gov/vuln/detail/CVE-2026-115923
Code Behaviors & Features
Detect and mitigate CVE-2026-115923 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →