[backstage-goalie]

This PR contains the following updates:

Package	Change	Age	Confidence
@backstage/backend-defaults (source)	0.17.7 → 0.17.8

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Backstage: Improper access control in backend action invocation

CVE-2026-106495 / GHSA-3xr5-8w6c-p5gw

More information

Details

Impact

An authenticated user could invoke actions that an operator had excluded through action configuration. Existing action permissions and downstream authorization remain enforced.

Patches

Patched in @backstage/backend-defaults version 0.17.8

Workarounds

Limit access to action invocation endpoints to trusted service callers until upgrading.

Severity

• CVSS Score: 4.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References

• https://github.com/backstage/backstage/security/advisories/GHSA-3xr5-8w6c-p5gw
• https://nvd.nist.gov/vuln/detail/CVE-2026-106495
• https://github.com/backstage/backstage/commit/a8fb34a990a69bcb745e85a3213cf9e5ba2d31a3
• https://github.com/backstage/backstage
• https://github.com/backstage/backstage/releases/tag/v1.54.6

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Backstage: Improper input validation in cloud storage URL readers

CVE-2026-106494 / GHSA-7649-wm97-w3j3

More information

Details

Impact

An attacker with write access to a cloud storage bucket used by Backstage could craft object names that could collide with protected files in the output directory. In certain deployment configurations, this could lead to content injection.

Patches

Patched in @backstage/backend-defaults version 0.17.8

Severity

• CVSS Score: 4.4 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N

References

• https://github.com/backstage/backstage/security/advisories/GHSA-7649-wm97-w3j3
• https://nvd.nist.gov/vuln/detail/CVE-2026-106494
• https://github.com/backstage/backstage/commit/14e925ce5b905dd8daa64c3009722febda76034c
• https://github.com/backstage/backstage
• https://github.com/backstage/backstage/releases/tag/v1.54.6

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Backstage: Improper preservation of access restrictions during service credential delegation

CVE-2026-106492 / GHSA-cq7v-rfgc-5c7v

More information

Details

Impact

An external service credential configured with access restrictions (e.g., read-only) could bypass those restrictions by routing requests through plugin delegation paths. This could allow a restricted service to perform operations beyond its intended scope, including write operations on plugins it was restricted to read-only access for.

Patches

Patched in @backstage/backend-defaults version 0.17.8

Workarounds

If you're unable to upgrade immediately:

• If practical, replace restricted credentials with separate, purpose-specific unrestricted credentials scoped to trusted consumers.
• Restrict network-level access to Backstage backend API endpoints to trusted callers only.

Severity

• CVSS Score: 7.6 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

References

• https://github.com/backstage/backstage/security/advisories/GHSA-cq7v-rfgc-5c7v
• https://nvd.nist.gov/vuln/detail/CVE-2026-106492
• https://github.com/backstage/backstage/commit/40346245c53e1bf26dee56601e95c5c4ab9cc124
• https://github.com/backstage/backstage/commit/bc80ffdafbc92ff7b8c72347eace13cb8688fd33
• https://github.com/backstage/backstage
• https://github.com/backstage/backstage/releases/tag/v1.49.6
• https://github.com/backstage/backstage/releases/tag/v1.54.6

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Backstage: Cloud storage catalog locations may cross configured storage boundaries

CVE-2026-106493 / GHSA-xvh9-35w9-42m4

More information

Details

Impact

Catalog entity providers for Azure Blob Storage and AWS S3 did not sufficiently validate storage object paths, which could allow catalog descriptors to be read from outside the intended storage boundary. Access is limited to locations reachable by the backend's configured credentials.

Patches

• @backstage/plugin-catalog-backend-module-azure version 0.3.21
• @backstage/plugin-catalog-backend-module-aws version 0.4.27
• @backstage/backend-defaults version 0.7.18

Workarounds

• Restrict blob and object creation or renaming in configured catalog storage sources to trusted principals.
• Scope Backstage's Azure and AWS reader credentials and network access to the intended storage boundaries.
• Disable an affected catalog provider if those restrictions cannot be enforced.

Severity

• CVSS Score: 3.0 / 10 (Low)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N

References

• https://github.com/backstage/backstage/security/advisories/GHSA-xvh9-35w9-42m4
• https://nvd.nist.gov/vuln/detail/CVE-2026-106493
• https://github.com/backstage/backstage/commit/47ddbd8b4a3efd812309f759c38f4877fbd9e5ff
• https://github.com/backstage/backstage
• https://github.com/backstage/backstage/releases/tag/v1.54.6

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

backstage/backstage (@​backstage/backend-defaults)

v0.17.8

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 76.89%. Comparing base (bf47fd9) to head (272b528).

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #11494   +/-   ##
=======================================
  Coverage   76.89%   76.89%           
=======================================
  Files         756      756           
  Lines       19609    19609           
  Branches     4630     4631    +1     
=======================================
  Hits        15078    15078           
  Misses       4482     4482           
  Partials       49       49           

Flag	Coverage Δ		*Carryforward flag
3scale	91.18% <ø> (ø)		Carriedforward from bf47fd9
acr	77.35% <ø> (ø)		Carriedforward from bf47fd9
argocd	94.44% <ø> (ø)		Carriedforward from bf47fd9
keycloak	97.21% <ø> (ø)		Carriedforward from bf47fd9
nexus-repository-manager	35.97% <ø> (ø)		Carriedforward from bf47fd9
npm	5.97% <ø> (ø)		Carriedforward from bf47fd9
ocm	78.26% <ø> (ø)		Carriedforward from bf47fd9
pingidentity	93.54% <ø> (ø)		Carriedforward from bf47fd9
quay	91.26% <ø> (ø)		Carriedforward from bf47fd9
rbac	81.53% <ø> (ø)		Carriedforward from bf47fd9
scaffolder-backend-module-annotator	97.60% <ø> (ø)		Carriedforward from bf47fd9
scaffolder-backend-module-kubernetes	100.00% <ø> (ø)
scaffolder-backend-module-regex	100.00% <ø> (ø)		Carriedforward from bf47fd9
scaffolder-backend-module-servicenow	80.43% <ø> (ø)		Carriedforward from bf47fd9
scaffolder-relation-processor	87.80% <ø> (ø)		Carriedforward from bf47fd9
servicenow	81.66% <ø> (ø)		Carriedforward from bf47fd9
tekton	78.01% <ø> (ø)		Carriedforward from bf47fd9
topology	64.32% <ø> (ø)		Carriedforward from bf47fd9

*This pull request uses carry forward flags. Click here to find out more.

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update bf47fd9...272b528. Read the comment docs.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[backstage-service]

👋 Reminder: This Renovate patch/minor PR has been open for 7 days.

Please review and merge if the changes look good. If no action is taken, this PR will be labeled force-merge in 7 days.