Is CVE-2026-106561 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-106561 being exploited in the wild.

How severe is CVE-2026-106561?

Medium severity, with a CVSS score of 5, published 7 October 2026.

Which products and versions are affected?

Backstage Plugin-Kubernetes-Backend < 0.21.9; @backstage/plugin-kubernetes-backend (npm) < 0.21.9, SEMVER:introduced=0,fixed=0.21.9.

How is CVE-2026-106561 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-106561?

Check whether you run Backstage Plugin-Kubernetes-Backend, Linuxfoundation Backstage\, Linuxfoundation Plugin-Kubernetes-Backend or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-106561: Backstage Kubernetes plugin sensitive information disclosure in resource queries

Q: Is there a fix for CVE-2026-106561?

Yes. @backstage/plugin-kubernetes-backend (npm): upgrade to 0.21.9 or later. Until then: Enable the Backstage permission framework and restrict the kubernetes.resources.read permission to trusted users. Scope the RBAC of the service account used by Backstage to access each cluster so it cannot read sensitive resource types. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-106561 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-106561?

Check whether you run Backstage Plugin-Kubernetes-Backend, Linuxfoundation Backstage\, Linuxfoundation Plugin-Kubernetes-Backend or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-106561 · Severity: medium · CVSS 5 · Published 2026-10-07

Backstage is an open-source developer portal that integrates with Kubernetes clusters to display and manage resources. Authenticated users with standard Kubernetes read permissions could retrieve masked sensitive values like credentials stored in the connected clusters, bypassing the plugin's intentional security controls. An attacker with legitimate access could gain unauthorized exposure to secrets and other confidential material.

Technologies: Linuxfoundation Backstage\, @backstage/plugin-kubernetes-backend (npm). Vendors: Backstage, Linuxfoundation, npm.

Quick answers

Is CVE-2026-106561 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-106561 being exploited in the wild.
How severe is CVE-2026-106561?: Medium severity, with a CVSS score of 5, published 7 October 2026.
Which products and versions are affected?: Backstage Plugin-Kubernetes-Backend < 0.21.9; @backstage/plugin-kubernetes-backend (npm) < 0.21.9, SEMVER:introduced=0,fixed=0.21.9.
Is there a fix for CVE-2026-106561?: Yes. @backstage/plugin-kubernetes-backend (npm): upgrade to 0.21.9 or later. Until then: Enable the Backstage permission framework and restrict the kubernetes.resources.read permission to trusted users. Scope the RBAC of the service account used by Backstage to access each cluster so it cannot read sensitive resource types. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-106561 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-106561?: Check whether you run Backstage Plugin-Kubernetes-Backend, Linuxfoundation Backstage\, Linuxfoundation Plugin-Kubernetes-Backend or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@backstage/plugin-kubernetes-backend (npm): upgrade to 0.21.9 or later
```
npm install @backstage/plugin-kubernetes-backend@0.21.9
```

Enable the Backstage permission framework and restrict the kubernetes.resources.read permission to trusted users. Scope the RBAC of the service account used by Backstage to access each cluster so it cannot read sensitive resource types.

Technical details

The Kubernetes plugin fails to properly mask sensitive field values in certain resource queries due to an authorization and information exposure flaw. An authenticated attacker with kubernetes.resources.read permission can query Kubernetes resources that the Backstage service account is permitted to read, bypassing masking controls on sensitive data fields. The vulnerability is limited to resources matching the targeted catalog entity's namespace and label selector, and only affects deployments where cluster credentials grant read access.

Affected products

Backstage plugin-kubernetes-backend < 0.21.9

Identifiers

CVE-2026-106561
GHSA-p795-mqf2-36mf

Timeline

2026-08-28: disclosed
2026-10-07: patched: Fixed in version 0.21.9

References

https://github.com/backstage/backstage/security/advisories/GHSA-p795-mqf2-36mf

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.