CVE-2026-106493: Backstage: Cloud storage catalog locations may cross configured storage boundaries
Backstage is an open framework for building developer portals. Prior to 1.54.6, cloud storage catalog providers did not sufficiently validate object paths. A principal able to create or rename objects in a configured Azure Blob Storage or AWS S3 catalog source could cause catalog descriptors to be read from outside the intended storage boundary, limited to locations reachable with the backend's configured credentials. This issue is fixed in 1.54.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Backstageto a version that resolves this vulnerability.Fixed in 1.54.6
Event History
Frequently Asked Questions
Who is exposed to this issue?
Backstage deployments using Azure Blob Storage or AWS S3 catalog sources are affected if they run a version earlier than 1.54.6. Exploitation also requires a principal that can create or rename objects in a configured catalog source.
What could an attacker access?
An attacker could cause Backstage to read catalog descriptors outside the intended storage boundary. Access is limited to storage locations that the Backstage backend's configured credentials can reach.
What should be done if upgrading is not immediately possible?
Restrict create and rename permissions on objects in configured Azure Blob Storage and AWS S3 catalog sources to trusted principals. Review the permissions granted to the Backstage backend credentials and limit their reachable storage locations where possible.
How can I remediate the issue?
Upgrade Backstage to version 1.54.6, which fixes the insufficient object-path validation.