CVE-2026-106561: @backstage/plugin kubernetes backend Remote Code Execution Vulnerability
MODERATECVE-2026-106561 is a MODERATE (CVSS 5.0) remote code execution vulnerability (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor) affecting @backstage/plugin kubernetes backend libraries in the npm ecosystem. The issue involves backstage has a sensitive information disclosure in kubernetes resource queries. Remediation is available by upgrading affected packages to version 0.21.9.
CVE-2026-106561 at a Glance
Security Impact
CVSS: 5.0
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N).
How to Fix CVE-2026-106561
To remediate this vulnerability, upgrade all affected @backstage/plugin kubernetes backend dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
npm install @backstage/plugin-kubernetes-backend@0.21.9Run the following command in your project directory to verify that all resolved dependencies use the patched release:
npm ls @backstage/plugin-kubernetes-backendHow to Check if You Are Affected
To determine whether your Node.js application is affected by CVE-2026-106561, inspect your project dependencies using npm:
npm ls @backstage/plugin-kubernetes-backendAnalyze the terminal output to locate any version of @backstage/plugin kubernetes backend in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 0.21.9), your application is affected.
Note: The npm ls @backstage/plugin-kubernetes-backend command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, where the product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. In @backstage/plugin kubernetes backend, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2026-106561 Affected @backstage/plugin kubernetes backend Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
@backstage/plugin-kubernetes-backend
|
npm |
< 0.21.9
|
0.21.9
|
References
Frequently Asked Questions
What is CVE-2026-106561?
Which @backstage/plugin kubernetes backend versions are affected?
What version fixes CVE-2026-106561?
Is @backstage/plugin-kubernetes-backend affected?
What is the CVSS score of CVE-2026-106561?
What CWE is associated with CVE-2026-106561?
How can I check npm dependencies for CVE-2026-106561?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-p795-mqf2-36mf",
"modified" : "2026-10-07T18:02:30Z",
"published" : "2026-10-07T18:02:30Z",
"aliases" : [ "CVE-2026-106561" ],
"summary" : "Backstage has a sensitive information disclosure in Kubernetes resource queries",
"details" : "### Impact\n\nAn authenticated user holding the standard Kubernetes resource read permission could retrieve sensitive values that the Kubernetes plugin is designed to mask, potentially exposing credentials and other confidential material held in the connected clusters. Exposure is limited to resources that the Backstage service account is permitted to read and that match the targeted catalog entity's namespace and label selector. Deployments whose cluster credentials do not grant read access to these resources are unaffected.\n\n### Patches\n\nFixed in @backstage/plugin-kubernetes-backend version 0.21.9 \n\nOne behavior change is worth noting for adopters who expose custom resources: a custom resource whose list kind is reported by the API server as SecretList now has the values of its data field masked, matching how core Kubernetes Secrets have always been handled on other query paths.\n\n### Workarounds\n\n- Enable the permission framework and restrict `kubernetes.resources.read` to trusted users.\n- Scope the RBAC of the service account used to reach each cluster so that it cannot read sensitive resource types. The recommended `ClusterRole` in the Kubernetes plugin configuration documentation does not grant this access.",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "npm",
"name" : "@backstage/plugin-kubernetes-backend"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "0.21.9"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/backstage/backstage/security/advisories/GHSA-p795-mqf2-36mf"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-106561"
}, {
"type" : "WEB",
"url" : "https://github.com/backstage/backstage/commit/388926ae5734bc20bd6a1520d02896be834f6527"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/backstage/backstage"
}, {
"type" : "WEB",
"url" : "https://github.com/backstage/backstage/releases/tag/v1.54.2"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-200", "CWE-863" ],
"severity" : "MODERATE",
"github_reviewed" : true,
"github_reviewed_at" : "2026-10-07T18:02:30Z",
"nvd_published_at" : "2026-10-07T15:17:17Z"
}
}