Is CVE-2026-115923 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-115923 being exploited in the wild.

How severe is CVE-2026-115923?

Medium severity, with a CVSS score of 6.5, published 26 October 2026.

Which products and versions are affected?

Backstage Plugin-Catalog-Backend prior to 3.9.2 and from 4.0.0 until 4.0.2; @backstage/plugin-catalog-backend (npm) < 3.9.2, SEMVER:introduced=0,fixed=3.9.2.

Is there a fix for CVE-2026-115923?

Yes. @backstage/plugin-catalog-backend (npm): upgrade to 3.9.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-115923 attacked?

It is attacked over the network.

Am I affected by CVE-2026-115923?

Check whether you run Backstage Plugin-Catalog-Backend or @backstage/plugin-catalog-backend (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-115923: Backstage catalog URL validation bypass

Q: Is there a fix for CVE-2026-115923?

Yes. @backstage/plugin-catalog-backend (npm): upgrade to 3.9.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-115923 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2026-115923?

Check whether you run Backstage Plugin-Catalog-Backend or @backstage/plugin-catalog-backend (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-115923 · Severity: medium · CVSS 6.5 · Published 2026-10-26

Backstage is a framework for building internal developer portals. Prior to versions 3.9.2 and 4.0.2, an authenticated user with permission to create catalog locations can bypass URL validation rules by using percent-encoded path segments, allowing them to load untrusted entity data from sources that should be blocked by the catalog security policy.

Technologies: Backstage Plugin-Catalog-Backend, @backstage/plugin-catalog-backend (npm). Vendors: Backstage, npm.

Quick answers

Is CVE-2026-115923 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-115923 being exploited in the wild.
How severe is CVE-2026-115923?: Medium severity, with a CVSS score of 6.5, published 26 October 2026.
Which products and versions are affected?: Backstage Plugin-Catalog-Backend prior to 3.9.2 and from 4.0.0 until 4.0.2; @backstage/plugin-catalog-backend (npm) < 3.9.2, SEMVER:introduced=0,fixed=3.9.2.
Is there a fix for CVE-2026-115923?: Yes. @backstage/plugin-catalog-backend (npm): upgrade to 3.9.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-115923 attacked?: It is attacked over the network.
Am I affected by CVE-2026-115923?: Check whether you run Backstage Plugin-Catalog-Backend or @backstage/plugin-catalog-backend (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@backstage/plugin-catalog-backend (npm): upgrade to 3.9.2 or later
```
npm install @backstage/plugin-catalog-backend@3.9.2
```

Technical details

The DefaultCatalogRulesEnforcer in @backstage/plugin-catalog-backend compares raw location.target URLs against catalog.rules, while URL readers canonicalize URLs before fetching, creating a mismatch. An authenticated attacker can use percent-encoded characters to make an untrusted URL match a trusted location pattern in the rule check, then have it resolve to an out-of-scope URL during actual content fetching. This requires catalog.location.create permission and downstream impact depends on deployment configuration.

Affected products

Backstage plugin-catalog-backend prior to 3.9.2 and from 4.0.0 until 4.0.2

Identifiers

CVE-2026-115923
GHSA-w658-mh9p-ww8f

Timeline

2026-10-26: disclosed
2026-10-21: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.