CVE-2026-106498

npm/@backstage/plugin-catalog-backend CVE-2026-106498: high 7.7, EPSS 0.31%

Backstage: Improper URL validation in catalog entity placeholder resolution

Action: Upgrade @backstage/plugin-catalog-backend to 3.9.1 or later.

npm i @backstage/plugin-catalog-backend@3.9.1

Affected

Fixed versions

Sources

• osv: GHSA-qgvj-qcf8-xq73
• https://github.com/backstage/backstage/security/advisories/GHSA-qgvj-qcf8-xq73
• https://nvd.nist.gov/vuln/detail/CVE-2026-106498
• https://github.com/backstage/backstage/commit/0b0f6fc89b4eb4872c76a498abbe1dc65998bb6e
• https://github.com/backstage/backstage/commit/286bfc1f9cc3608a073b41016be302785be385d1
• https://github.com/backstage/backstage/commit/61a10f19926aeda7f4a32de48d733e6710584634
• https://github.com/backstage/backstage/commit/99729e925fd2bd40ba210022351a0ee6318e6197
• https://github.com/backstage/backstage/commit/e786ac309ed2d775daf2309393c015c43902d6f6
• https://github.com/backstage/backstage
• https://github.com/backstage/backstage/releases/tag/v1.49.6
• https://github.com/backstage/backstage/releases/tag/v1.50.5
• https://github.com/backstage/backstage/releases/tag/v1.51.3
• https://github.com/backstage/backstage/releases/tag/v1.53.2
• https://github.com/backstage/backstage/releases/tag/v1.54.6

CVE-2026-106498 · published 2026-10-07T17:59:24Z · modified 2026-10-07T18:15:10.710570023Z · JSON