CVE-2026-106561: Backstage: Sensitive information disclosure in Kubernetes resource queries
Impact
An authenticated user holding the standard Kubernetes resource read permission could retrieve sensitive values that the Kubernetes plugin is designed to mask, potentially exposing credentials and other confidential material held in the connected clusters. Exposure is limited to resources that the Backstage service account is permitted to read and that match the targeted catalog entity's namespace and label selector. Deployments whose cluster credentials do not grant read access to these resources are unaffected.
Patches
Fixed in @backstage/plugin-kubernetes-backend version 0.21.9
One behavior change is worth noting for adopters who expose custom resources: a custom resource whose list kind is reported by the API server as SecretList now has the values of its data field masked, matching how core Kubernetes Secrets have always been handled on other query paths.
Workarounds
- Enable the permission framework and restrict kubernetes.resources.read to trusted users. - Scope the RBAC of the service account used to reach each cluster so that it cannot read sensitive resource types. The recommended ClusterRole in the Kubernetes plugin configuration documentation does not grant this access.
Other sources
Backstage is an open framework for building developer portals. Prior to 0.21.9, the @backstage/plugin-kubernetes-backend package is affected by sensitive information disclosure in kubernetes resource queries. An authenticated user holding the standard Kubernetes resource read permission could retrieve sensitive values that the Kubernetes plugin is designed to mask, potentially exposing credentials and other confidential material held in the connected clusters. Exposure is limited to resources that the Backstage service account is permitted to read and that match the targeted catalog entity's namespace and label selector. Deployments whose cluster credentials do not grant read access to these resources are unaffected. This issue is fixed in version 0.21.9.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/@backstage/plugin-kubernetes-backendto a version that resolves this vulnerability.Fixed in 0.21.9 - Upgrade
Upgrade
@backstage/plugin-kubernetes-backendto a version that resolves this vulnerability.Fixed in 0.21.9 - Configuration
Enable the permission framework and restrict kubernetes.resources.read to trusted users.
Backstage permission framework kubernetes.resources.read = restricted to trusted users - Configuration
Scope the service account RBAC for each cluster so it cannot read sensitive resource types.
Kubernetes RBAC service account used by the plugin resource read permissions = exclude sensitive resource types
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using @backstage/plugin-kubernetes-backend versions earlier than 0.21.9 are exposed only when the Backstage service account can read the relevant Kubernetes resources. The resources must also match the targeted catalog entity's namespace and label selector.
What access does an attacker need?
An attacker must be an authenticated Backstage user with the standard Kubernetes resource read permission. No user interaction is required.
What information could be disclosed?
The issue can reveal sensitive values that the Kubernetes plugin is intended to mask, including credentials and other confidential material stored in connected clusters.
How can the exposure be mitigated if an upgrade cannot happen immediately?
Restrict the Backstage service account so it does not have read access to sensitive Kubernetes resources. Deployments whose cluster credentials lack read access to the affected resources are not affected.
What version fixes the issue?
Upgrade @backstage/plugin-kubernetes-backend to version 0.21.9.