# CVE-2026-115923: Backstage catalog URL validation bypass

Source: https://junglewise.ai/threats/cve-2026-115923-backstage-is-an-open-framework-for-building-developer-portals  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-26. Updated: 2026-10-26  
License: CC BY 4.0 with a link back

CVE-2026-115923 · Severity: medium · CVSS 6.5 · Published 2026-10-26

Backstage is a framework for building internal developer portals. Prior to versions 3.9.2 and 4.0.2, an authenticated user with permission to create catalog locations can bypass URL validation rules by using percent-encoded path segments, allowing them to load untrusted entity data from sources that should be blocked by the catalog security policy.

Technologies: [Backstage Plugin-Catalog-Backend](https://junglewise.ai/threats/technologies/plugin-catalog-backend), [@backstage/plugin-catalog-backend (npm)](https://junglewise.ai/threats/technologies/backstage-plugin-catalog-backend). Vendors: [Backstage](https://junglewise.ai/threats/vendors/backstage), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-115923 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-115923 being exploited in the wild.

**How severe is CVE-2026-115923?** Medium severity, with a CVSS score of 6.5, published 26 October 2026.

**Which products and versions are affected?** Backstage Plugin-Catalog-Backend prior to 3.9.2 and from 4.0.0 until 4.0.2; @backstage/plugin-catalog-backend (npm) < 3.9.2, SEMVER:introduced=0,fixed=3.9.2.

**Is there a fix for CVE-2026-115923?** Yes. @backstage/plugin-catalog-backend (npm): upgrade to 3.9.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-115923 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-115923?** Check whether you run Backstage Plugin-Catalog-Backend or @backstage/plugin-catalog-backend (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @backstage/plugin-catalog-backend (npm): upgrade to 3.9.2 or later

  ```sh
  npm install @backstage/plugin-catalog-backend@3.9.2
  ```


## Technical details

The DefaultCatalogRulesEnforcer in @backstage/plugin-catalog-backend compares raw location.target URLs against catalog.rules, while URL readers canonicalize URLs before fetching, creating a mismatch. An authenticated attacker can use percent-encoded characters to make an untrusted URL match a trusted location pattern in the rule check, then have it resolve to an out-of-scope URL during actual content fetching. This requires catalog.location.create permission and downstream impact depends on deployment configuration.

## Affected products

- Backstage plugin-catalog-backend prior to 3.9.2 and from 4.0.0 until 4.0.2

## Identifiers

- CVE-2026-115923
- GHSA-w658-mh9p-ww8f

## Timeline

- 2026-10-26: disclosed
- 2026-10-21: patched

## References

- [https://github.com/backstage/backstage/commit/3214dc8f15d4a08a2fd07a72a8fe4d00aeac0db4](https://github.com/backstage/backstage/commit/3214dc8f15d4a08a2fd07a72a8fe4d00aeac0db4)
- [https://github.com/backstage/backstage/commit/737ff1c719dbd5a97f375b7f1db6d61416618419](https://github.com/backstage/backstage/commit/737ff1c719dbd5a97f375b7f1db6d61416618419)

## Related threats

- [Backstage catalog entity placeholder URL validation bypass](https://junglewise.ai/threats/cve-2026-106498-backstage-is-an-open-framework-for-building-developer-portals)
- [Backstage plugin-catalog-backend permission evaluation bypass](https://junglewise.ai/threats/cve-2026-106497-backstage-is-an-open-framework-for-building-developer-portals)
- [Backstage: Inconsistent enforcement of allowed location types during catalog processing](https://junglewise.ai/threats/cve-2026-106496-backstage-is-an-open-framework-for-building-developer-portals)
- [Backstage plugin-catalog-backend prototype pollution](https://junglewise.ai/threats/cve-2024-45815-backstage-plugin-catalog-backend-prototype-pollution)
- [Backstage Cross-site scripting in Software Catalog](https://junglewise.ai/threats/cve-2023-25571-backstage-cross-site-scripting-in-software-catalog)