Repository navigation
Update dependency @backstage/plugin-catalog-backend to v3.9.2 [SECURITY] - #11812
Open
backstage-goalie[bot] wants to merge 1 commit into
Open
backstage-goalie[bot] wants to merge 1 commit into
backstage-goalie[bot] wants to merge 1 commit into
Conversation
backstage-goalie
Bot
added
dependencies
backstage-goalie
Bot
requested review from
AndrienkoAleksandr,
HusneShabbir,
PatAKnight,
christoph-jerolimov,
debsmita1,
divyanshiGupta,
dzemanov,
its-mitesh-kumar,
jrichter1 and
karthikjeeyar
as code owners
October 29, 2026 01:16
backstage-goalie
Bot
requested review from
a team,
djanickova and
rohitkrai03
as code owners
October 29, 2026 01:16
backstage-goalie
Bot
force-pushed
the
renovate/workspace-rbac/npm-backstage-plugin-catalog-backend-vulnerability
branch
from
October 29, 2026 02:19
2add1a0 to
4f709f6
Compare
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #11812 +/- ##
=======================================
Coverage 76.89% 76.89%
=======================================
Files 756 756
Lines 19609 19609
Branches 4631 4646 +15
=======================================
Hits 15078 15078
Misses 4482 4482
Partials 49 49
*This pull request uses carry forward flags. Click here to find out more. Continue to review full report in Codecov by Harness.
🚀 New features to boost your workflow:
|
backstage-goalie
Bot
force-pushed
the
renovate/workspace-rbac/npm-backstage-plugin-catalog-backend-vulnerability
branch
6 times, most recently
from
October 30, 2026 19:19
425c42c to
3c21d7d
Compare
Signed-off-by: Renovate Bot <bot@renovateapp.com>
backstage-goalie
Bot
force-pushed
the
renovate/workspace-rbac/npm-backstage-plugin-catalog-backend-vulnerability
branch
from
October 31, 2026 00:24
3c21d7d to
cbfdbb1
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
3.9.1→3.9.2Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
Backstage catalog rules can be bypassed for URL locations using encoded path segments
CVE-2026-115923 / GHSA-w658-mh9p-ww8f
More information
Details
Summary
@backstage/plugin-catalog-backendmatches URL-type locations againstcatalog.ruleslocation patterns using the raw URL string submitted by the user, while URL readers resolve that same string in canonical form when fetching the location's content. A URL can therefore be crafted so that it appears to belong to a trusted location scope during rule evaluation, but is fetched from a different scope.Details
When a deployment restricts catalog kinds to trusted URL prefixes using
catalog.ruleslocation patterns,DefaultCatalogRulesEnforcerapplies glob matching directly to the rawlocation.targetstring. The URL readers used for ingestion resolve the same target in canonical form, including normalizing percent-encoded dot segments. A registered location such ashttps://<host>/trusted/%2e%2e/attacker/repo/blob/main/catalog-info.yamlmatches ahttps://<host>/trusted/**pattern as a raw string, but resolves to and is fetched fromhttps://<host>/attacker/repo/...when its content is read.An authenticated user with permission to register catalog locations (
catalog.location.create) can use this to have an entity from an untrusted source admitted as if it originated from a trusted location scope.Impact
The crossed boundary is the operator-configured catalog ingestion policy: entity content from outside the trusted location scope is ingested as if it were within it. Downstream consequences depend on deployment configuration, for example actions taken with integration credentials by processors or scaffolder when acting on the ingested entity. The assessment of this report found no basis for impact claims beyond the ingestion policy boundary itself.
Patches
This is fixed in
@backstage/plugin-catalog-backend3.9.2 (Backstage release 1.54.10) and 4.0.2 (Backstage release 1.56.1). Version 4.0.1 as published is not fixed.Workarounds
No complete workaround is available for deployments that rely on URL location patterns to restrict catalog kinds. Restricting location registration permissions reduces exposure.
Severity
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Release Notes
backstage/backstage (@backstage/plugin-catalog-backend)
v3.9.2Compare Source
Patch Changes
7761a50: Improved path validation for catalog entity placeholders.fda0ef1: Correct catalog property permission matching.e363ae2: Allowed location type restrictions are now applied consistently during catalog processing.Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate CLI.