[backstage-goalie]

This PR contains the following updates:

Package	Change	Age	Confidence
@backstage/backend-defaults (source)	0.17.7 → 0.17.8

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Backstage: Improper access control in backend action invocation

CVE-2026-106495 / GHSA-3xr5-8w6c-p5gw

More information

Details

Impact

An authenticated user could invoke actions that an operator had excluded through action configuration. Existing action permissions and downstream authorization remain enforced.

Patches

Patched in @backstage/backend-defaults version 0.17.8

Workarounds

Limit access to action invocation endpoints to trusted service callers until upgrading.

Severity

• CVSS Score: 4.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References

• https://github.com/backstage/backstage/security/advisories/GHSA-3xr5-8w6c-p5gw
• https://nvd.nist.gov/vuln/detail/CVE-2026-106495
• https://github.com/backstage/backstage/commit/a8fb34a990a69bcb745e85a3213cf9e5ba2d31a3
• https://github.com/backstage/backstage
• https://github.com/backstage/backstage/releases/tag/v1.54.6

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Backstage: Improper input validation in cloud storage URL readers

CVE-2026-106494 / GHSA-7649-wm97-w3j3

More information

Details

Impact

An attacker with write access to a cloud storage bucket used by Backstage could craft object names that could collide with protected files in the output directory. In certain deployment configurations, this could lead to content injection.

Patches

Patched in @backstage/backend-defaults version 0.17.8

Severity

• CVSS Score: 4.4 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N

References

• https://github.com/backstage/backstage/security/advisories/GHSA-7649-wm97-w3j3
• https://nvd.nist.gov/vuln/detail/CVE-2026-106494
• https://github.com/backstage/backstage/commit/14e925ce5b905dd8daa64c3009722febda76034c
• https://github.com/backstage/backstage
• https://github.com/backstage/backstage/releases/tag/v1.54.6

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Backstage: Improper preservation of access restrictions during service credential delegation

CVE-2026-106492 / GHSA-cq7v-rfgc-5c7v

More information

Details

Impact

An external service credential configured with access restrictions (e.g., read-only) could bypass those restrictions by routing requests through plugin delegation paths. This could allow a restricted service to perform operations beyond its intended scope, including write operations on plugins it was restricted to read-only access for.

Patches

Patched in @backstage/backend-defaults version 0.17.8

Workarounds

If you're unable to upgrade immediately:

• If practical, replace restricted credentials with separate, purpose-specific unrestricted credentials scoped to trusted consumers.
• Restrict network-level access to Backstage backend API endpoints to trusted callers only.

Severity

• CVSS Score: 7.6 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

References

• https://github.com/backstage/backstage/security/advisories/GHSA-cq7v-rfgc-5c7v
• https://nvd.nist.gov/vuln/detail/CVE-2026-106492
• https://github.com/backstage/backstage/commit/40346245c53e1bf26dee56601e95c5c4ab9cc124
• https://github.com/backstage/backstage/commit/bc80ffdafbc92ff7b8c72347eace13cb8688fd33
• https://github.com/backstage/backstage
• https://github.com/backstage/backstage/releases/tag/v1.49.6
• https://github.com/backstage/backstage/releases/tag/v1.54.6

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Backstage: Cloud storage catalog locations may cross configured storage boundaries

CVE-2026-106493 / GHSA-xvh9-35w9-42m4

More information

Details

Impact

Catalog entity providers for Azure Blob Storage and AWS S3 did not sufficiently validate storage object paths, which could allow catalog descriptors to be read from outside the intended storage boundary. Access is limited to locations reachable by the backend's configured credentials.

Patches

• @backstage/plugin-catalog-backend-module-azure version 0.3.21
• @backstage/plugin-catalog-backend-module-aws version 0.4.27
• @backstage/backend-defaults version 0.7.18

Workarounds

• Restrict blob and object creation or renaming in configured catalog storage sources to trusted principals.
• Scope Backstage's Azure and AWS reader credentials and network access to the intended storage boundaries.
• Disable an affected catalog provider if those restrictions cannot be enforced.

Severity

• CVSS Score: 3.0 / 10 (Low)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N

References

• https://github.com/backstage/backstage/security/advisories/GHSA-xvh9-35w9-42m4
• https://nvd.nist.gov/vuln/detail/CVE-2026-106493
• https://github.com/backstage/backstage/commit/47ddbd8b4a3efd812309f759c38f4877fbd9e5ff
• https://github.com/backstage/backstage
• https://github.com/backstage/backstage/releases/tag/v1.54.6

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

backstage/backstage (@​backstage/backend-defaults)

v0.17.8

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[backstage-service]

👋 Reminder: This Renovate patch/minor PR has been open for 7 days.

Please review and merge if the changes look good. If no action is taken, this PR will be labeled force-merge in 7 days.