CVE-2026-106487: Backstage: Unsupported catalog cluster authentication mode in kubernetes backend

CVE-2026-106487 · Severity: low · CVSS 3.5 · Published 2026-10-06

Backstage is an open framework for building developer portals. Prior to 0.21.10, the @backstage/plugin-kubernetes-backend package is affected by unsupported catalog cluster authentication mode in kubernetes backend. Deployments using catalog cluster discovery may be affected when catalog contributors can create or modify kubernetes-cluster Resource entities. With the required endpoint permissions and pod RBAC, the backend can use its local in-cluster identity, potentially exposing Kubernetes resources readable by that identity. The credential is used only with the local in-cluster API endpoint and is not sent to the catalog-supplied endpoint. This issue is fixed in version 0.21.10.

Technologies: @backstage/plugin-kubernetes-backend (npm). Vendors: npm.

Quick answers

Is CVE-2026-106487 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-106487 being exploited in the wild.
How severe is CVE-2026-106487?
Low severity, with a CVSS score of 3.5, published 6 October 2026.
Which products and versions are affected?
@backstage/plugin-kubernetes-backend (npm) < 0.21.10, SEMVER:introduced=0,fixed=0.21.10.
Is there a fix for CVE-2026-106487?
Yes. @backstage/plugin-kubernetes-backend (npm): upgrade to 0.21.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
Am I affected by CVE-2026-106487?
Check whether you run @backstage/plugin-kubernetes-backend (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @backstage/plugin-kubernetes-backend (npm): upgrade to 0.21.10 or later
    npm install @backstage/plugin-kubernetes-backend@0.21.10

Affected products

  • @backstage/plugin-kubernetes-backend (npm) < 0.21.10, SEMVER:introduced=0,fixed=0.21.10

Identifiers

  • CVE-2026-106487
  • GHSA-h53x-hjx6-25gr

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.