CVE-2026-106487

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 0.21.10

Description The @backstage/plugin-kubernetes-backend package contains an unsupported catalog cluster authentication mode. In deployments utilizing catalog cluster discovery, the issue arises when catalog contributors possess permissions to create or modify kubernetes-cluster Resource entities. If the backend has the necessary endpoint permissions and pod RBAC (Role-Based Access Control), it may use its local in-cluster identity, which could expose Kubernetes resources accessible to that identity. The credential is restricted to the local in-cluster API endpoint and is not transmitted to the catalog-supplied endpoint.

Recommendations Update to version 0.21.10.