Linuxfoundation Backstage
12 CVEs affecting Linuxfoundation Backstage. Latest disclosed: 2026-03-12. Critical: 0, High: 4.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-43783 | High | 8.5 | 2021-11-29 | @backstage/plugin-scaffolder-backend is the backend for the default Backstage software templates. In affected versions a malicious actor with write access to a… |
CVE-2023-35926 | High | 8.0 | 2023-06-22 | Backstage is an open platform for building developer portals. The Backstage scaffolder-backend plugin uses a templating library that requires sandbox, as it by… |
CVE-2026-25153 | High | 7.7 | 2026-01-30 | Backstage is an open framework for building developer portals, and @backstage/plugin-techdocs-node provides common node.js functionalities for TechDocs. In ver… |
CVE-2026-32236 | High | 7.5 | 2026-03-12 | Backstage is an open framework for building developer portals. Prior to 0.27.1, a Server-Side Request Forgery (SSRF) vulnerability exists in @backstage/plugin-… |
CVE-2021-41151 | Medium | 6.8 | 2021-10-18 | Backstage is an open platform for building developer portals. In affected versions A malicious actor could read sensitive files from the environment where Scaf… |
CVE-2024-46976 | Medium | 6.5 | 2024-09-17 | Backstage is an open framework for building developer portals. An attacker with control of the contents of the TechDocs storage buckets is able to inject execu… |
CVE-2024-45816 | Medium | 6.5 | 2024-09-17 | Backstage is an open framework for building developer portals. When using the AWS S3 or GCS storage provider for TechDocs it is possible to access content in t… |
CVE-2024-45815 | Medium | 6.5 | 2024-09-17 | Backstage is an open framework for building developer portals. A malicious actor with authenticated access to a Backstage instance with the catalog backend plu… |
CVE-2021-32662 | Medium | 6.5 | 2021-06-03 | Backstage is an open platform for building developer portals, and techdocs-common contains common functionalities for Backstage's TechDocs. In `@backstage/tech… |
CVE-2026-32235 | Medium | 5.9 | 2026-03-12 | Backstage is an open framework for building developer portals. Prior to 0.27.1, the experimental OIDC provider in @backstage/plugin-auth-backend is vulnerable… |
CVE-2023-6944 | Medium | 5.7 | 2024-01-04 | A flaw was found in the Red Hat Developer Hub (RHDH). The catalog-import function leaks GitLab access tokens on the frontend when the base64 encoded GitLab tok… |
CVE-2026-25152 | Medium | 5.3 | 2026-01-30 | Backstage is an open framework for building developer portals, and @backstage/plugin-techdocs-node provides common node.js functionalities for TechDocs. In ver… |