# CVE-2026-106487: Backstage: Unsupported catalog cluster authentication mode in kubernetes backend

Source: https://junglewise.ai/threats/cve-2026-106487-backstage-is-an-open-framework-for-building-developer-portals  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-06  
License: CC BY 4.0 with a link back

CVE-2026-106487 · Severity: low · CVSS 3.5 · Published 2026-10-06

Backstage is an open framework for building developer portals. Prior to 0.21.10, the @backstage/plugin-kubernetes-backend package is affected by unsupported catalog cluster authentication mode in kubernetes backend. Deployments using catalog cluster discovery may be affected when catalog contributors can create or modify kubernetes-cluster Resource entities. With the required endpoint permissions and pod RBAC, the backend can use its local in-cluster identity, potentially exposing Kubernetes resources readable by that identity. The credential is used only with the local in-cluster API endpoint and is not sent to the catalog-supplied endpoint. This issue is fixed in version 0.21.10.

Technologies: [@backstage/plugin-kubernetes-backend (npm)](https://junglewise.ai/threats/technologies/backstage-plugin-kubernetes-backend). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-106487 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-106487 being exploited in the wild.

**How severe is CVE-2026-106487?** Low severity, with a CVSS score of 3.5, published 6 October 2026.

**Which products and versions are affected?** @backstage/plugin-kubernetes-backend (npm) < 0.21.10, SEMVER:introduced=0,fixed=0.21.10.

**Is there a fix for CVE-2026-106487?** Yes. @backstage/plugin-kubernetes-backend (npm): upgrade to 0.21.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2026-106487?** Check whether you run @backstage/plugin-kubernetes-backend (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @backstage/plugin-kubernetes-backend (npm): upgrade to 0.21.10 or later

  ```sh
  npm install @backstage/plugin-kubernetes-backend@0.21.10
  ```


## Affected products

- @backstage/plugin-kubernetes-backend (npm) < 0.21.10, SEMVER:introduced=0,fixed=0.21.10

## Identifiers

- CVE-2026-106487
- GHSA-h53x-hjx6-25gr

## Related threats

- [Backstage improper entity validation in Kubernetes services endpoint](https://junglewise.ai/threats/cve-2026-106563-backstage-improper-entity-validation-in-deprecated-kubernetes)
- [Backstage Kubernetes plugin sensitive information disclosure in resource queries](https://junglewise.ai/threats/cve-2026-106561-backstage-has-a-sensitive-information-disclosure-in-kubernetes)