{"schema_version":1,"title":"Backstage vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 29 vulnerabilities in Backstage: 0 in the last 7 days and 3 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-88064, was published on 16 September 2026. 4 technologies have a page of their own.","url":"https://junglewise.ai/threats/vendors/backstage","json_url":"https://junglewise.ai/threats/vendors/backstage.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/vendors/backstage","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"vendor","counts":{"high":4,"all_time":29,"critical":0,"exploited":0,"last_7_days":0,"last_30_days":1,"last_90_days":3,"last_365_days":13},"latest":[{"cve":"CVE-2026-88064","cvss":8.8,"epss":0.0088,"slug":"cve-2026-88064-backstage-techdocs-yaml-injection-in-mkdocs-configuration","title":"Backstage TechDocs YAML injection in mkdocs configuration","severity":"high","exploited":false,"published_at":"2026-09-16T15:18:04.297+00:00","url":"https://junglewise.ai/threats/cve-2026-88064-backstage-techdocs-yaml-injection-in-mkdocs-configuration"},{"cve":"CVE-2026-73563","cvss":3.1,"epss":0.0028,"slug":"cve-2026-73563-backstage-plugin-auth-backend-oauth-redirect-uri-allowlist-bypass","title":"Backstage plugin-auth-backend OAuth redirect_uri allowlist bypass","severity":"low","exploited":false,"published_at":"2026-07-24T16:20:59+00:00","url":"https://junglewise.ai/threats/cve-2026-73563-backstage-plugin-auth-backend-oauth-redirect-uri-allowlist-bypass"},{"cvss":4.7,"slug":"backstage-backstage-plugin-auth-backend-oauth-allowlist-bypass-fd6ff5e7","title":"Backstage @backstage/plugin-auth-backend OAuth allowlist bypass","severity":"medium","exploited":false,"published_at":"2026-07-24T16:20:59+00:00","url":"https://junglewise.ai/threats/backstage-backstage-plugin-auth-backend-oauth-allowlist-bypass-fd6ff5e7"},{"cve":"CVE-2026-44374","cvss":4.3,"epss":0.0028,"slug":"cve-2026-44374-backstage-incorrect-authorization-in-catalog-unprocessed-entities","title":"Backstage incorrect authorization in catalog unprocessed entities module","severity":"medium","exploited":false,"published_at":"2026-05-14T15:16:48.25+00:00","url":"https://junglewise.ai/threats/cve-2026-44374-backstage-incorrect-authorization-in-catalog-unprocessed-entities"},{"cve":"CVE-2026-32237","cvss":3.1,"epss":0.0041,"slug":"cve-2026-32237-backstage-scaffolder-backend-secret-exposure-in-dry-run-endpoint","title":"Backstage Scaffolder Backend secret exposure in dry-run endpoint","severity":"low","exploited":false,"published_at":"2026-03-12T14:51:06+00:00","url":"https://junglewise.ai/threats/cve-2026-32237-backstage-scaffolder-backend-secret-exposure-in-dry-run-endpoint"},{"cve":"CVE-2026-32236","cvss":4,"epss":0.0047,"slug":"cve-2026-32236-backstage-auth-backend-ssrf-in-cimd-metadata-fetch","title":"Backstage auth-backend SSRF in CIMD metadata fetch","severity":"medium","exploited":false,"published_at":"2026-03-12T14:51:02+00:00","url":"https://junglewise.ai/threats/cve-2026-32236-backstage-auth-backend-ssrf-in-cimd-metadata-fetch"},{"cve":"CVE-2026-32235","cvss":3.1,"epss":0.0023,"slug":"cve-2026-32235-backstage-auth-backend-oauth-redirect-uri-allowlist-bypass","title":"Backstage Auth Backend OAuth redirect URI allowlist bypass","severity":"low","exploited":false,"published_at":"2026-03-12T14:50:59+00:00","url":"https://junglewise.ai/threats/cve-2026-32235-backstage-auth-backend-oauth-redirect-uri-allowlist-bypass"},{"cve":"CVE-2026-29186","cvss":7.7,"epss":0.0091,"slug":"cve-2026-29186-backstage-techdocs-arbitrary-code-execution-via-mkdocs","title":"Backstage TechDocs arbitrary code execution via MkDocs configuration bypass","severity":"high","exploited":false,"published_at":"2026-03-07T15:15:55.4+00:00","url":"https://junglewise.ai/threats/cve-2026-29186-backstage-techdocs-arbitrary-code-execution-via-mkdocs"},{"cve":"CVE-2026-29184","cvss":3.1,"epss":0.0029,"slug":"cve-2026-29184-backstage-plugin-scaffolder-backend-log-redaction-bypass","title":"Backstage plugin-scaffolder-backend log redaction bypass","severity":"low","exploited":false,"published_at":"2026-03-05T00:23:51+00:00","url":"https://junglewise.ai/threats/cve-2026-29184-backstage-plugin-scaffolder-backend-log-redaction-bypass"},{"cve":"CVE-2026-25153","cvss":7.7,"epss":0.0058,"slug":"cve-2026-25153-backstage-techdocs-code-execution-via-mkdocs-hooks-configuration","title":"Backstage TechDocs code execution via MkDocs hooks configuration","severity":"high","exploited":false,"published_at":"2026-01-30T22:15:56.343+00:00","url":"https://junglewise.ai/threats/cve-2026-25153-backstage-techdocs-code-execution-via-mkdocs-hooks-configuration"},{"cve":"CVE-2026-24046","cvss":7.1,"epss":0.0053,"slug":"cve-2026-24046-backstage-scaffolder-symlink-path-traversal-in-multiple-actions","title":"Backstage Scaffolder symlink path traversal in multiple actions","severity":"high","exploited":false,"published_at":"2026-01-21T23:15:53.24+00:00","url":"https://junglewise.ai/threats/cve-2026-24046-backstage-scaffolder-symlink-path-traversal-in-multiple-actions"},{"cve":"CVE-2026-24048","cvss":3.1,"epss":0.0023,"slug":"cve-2026-24048-backstage-ssrf-in-fetchurlreader-via-http-redirects","title":"Backstage SSRF in FetchUrlReader via HTTP redirects","severity":"low","exploited":false,"published_at":"2026-01-21T22:49:37+00:00","url":"https://junglewise.ai/threats/cve-2026-24048-backstage-ssrf-in-fetchurlreader-via-http-redirects"},{"cve":"CVE-2026-24047","cvss":3.1,"epss":0.0054,"slug":"cve-2026-24047-backstage-resolvesafechildpath-path-traversal-bypass-via-symlinks","title":"Backstage cli-common symlink chain bypass in resolveSafeChildPath","severity":"low","exploited":false,"published_at":"2026-01-21T22:40:51+00:00","url":"https://junglewise.ai/threats/cve-2026-24047-backstage-resolvesafechildpath-path-traversal-bypass-via-symlinks"},{"cve":"CVE-2025-55285","cvss":3.1,"slug":"cve-2025-55285-backstage-scaffolder-secret-leakage-in-logs-via-fetch-template","title":"Backstage Scaffolder secret leakage in logs via fetch:template","severity":"low","exploited":false,"published_at":"2025-08-15T18:43:16+00:00","url":"https://junglewise.ai/threats/cve-2025-55285-backstage-scaffolder-secret-leakage-in-logs-via-fetch-template"},{"cve":"CVE-2025-32791","cvss":3.1,"epss":0.0029,"slug":"cve-2025-32791-backstage-permission-backend-information-disclosure-in-policy","title":"Backstage permission backend information disclosure in policy decisions","severity":"low","exploited":false,"published_at":"2025-04-16T15:34:21+00:00","url":"https://junglewise.ai/threats/cve-2025-32791-backstage-permission-backend-information-disclosure-in-policy"},{"cve":"CVE-2024-47762","cvss":3.1,"epss":0.0038,"slug":"cve-2024-47762-backstage-plugin-app-backend-environment-variable-visibility","title":"Backstage plugin-app-backend environment variable visibility bypass","severity":"low","exploited":false,"published_at":"2024-10-03T16:51:24+00:00","url":"https://junglewise.ai/threats/cve-2024-47762-backstage-plugin-app-backend-environment-variable-visibility"},{"cve":"CVE-2024-46976","cvss":3.1,"epss":0.0029,"slug":"cve-2024-46976-backstage-techdocs-plugin-xss-circumvention-via-storage-bucket","title":"Backstage TechDocs plugin XSS circumvention via storage bucket injection","severity":"low","exploited":false,"published_at":"2024-09-17T21:31:28+00:00","url":"https://junglewise.ai/threats/cve-2024-46976-backstage-techdocs-plugin-xss-circumvention-via-storage-bucket"},{"cve":"CVE-2024-45816","cvss":3.1,"slug":"cve-2024-45816-backstage-techdocs-directory-traversal-in-storage-bucket","title":"Backstage TechDocs directory traversal in storage bucket","severity":"low","exploited":false,"published_at":"2024-09-17T21:30:20+00:00","url":"https://junglewise.ai/threats/cve-2024-45816-backstage-techdocs-directory-traversal-in-storage-bucket"},{"cve":"CVE-2024-45815","cvss":3.1,"slug":"cve-2024-45815-backstage-plugin-catalog-backend-prototype-pollution","title":"Backstage plugin-catalog-backend prototype pollution","severity":"low","exploited":false,"published_at":"2024-09-17T21:29:49+00:00","url":"https://junglewise.ai/threats/cve-2024-45815-backstage-plugin-catalog-backend-prototype-pollution"},{"cve":"CVE-2024-26150","cvss":3.1,"slug":"cve-2024-26150-backstage-backstage-backend-common-path-traversal-via-symlinks","title":"Backstage @backstage/backend-common path traversal via symlinks","severity":"low","exploited":false,"published_at":"2024-02-23T18:02:08+00:00","url":"https://junglewise.ai/threats/cve-2024-26150-backstage-backstage-backend-common-path-traversal-via-symlinks"},{"cve":"CVE-2023-6944","cvss":3.1,"epss":0.0056,"slug":"cve-2023-6944-backstage-backend-app-api-gitlab-token-leak-in-error-logs","title":"Backstage backend-app-api GitLab token leak in error logs","severity":"low","exploited":false,"published_at":"2024-01-04T12:30:20+00:00","url":"https://junglewise.ai/threats/cve-2023-6944-backstage-backend-app-api-gitlab-token-leak-in-error-logs"},{"cve":"CVE-2023-35926","cvss":3.1,"epss":0.0189,"slug":"cve-2023-35926-backstage-scaffolder-plugin-insecure-sandbox-in-code-execution","title":"Backstage Scaffolder plugin insecure sandbox in code execution","severity":"low","exploited":false,"published_at":"2023-06-21T22:00:30+00:00","url":"https://junglewise.ai/threats/cve-2023-35926-backstage-scaffolder-plugin-insecure-sandbox-in-code-execution"},{"cve":"CVE-2021-43776","cvss":3.1,"epss":0.0068,"slug":"cve-2021-43776-backstage-plugin-auth-backend-reflected-cross-site-scripting","title":"Backstage plugin-auth-backend reflected cross-site scripting","severity":"low","exploited":false,"published_at":"2021-12-01T18:29:21+00:00","url":"https://junglewise.ai/threats/cve-2021-43776-backstage-plugin-auth-backend-reflected-cross-site-scripting"},{"slug":"backstage-scaffolder-backend-remote-code-execution-in-v1beta3-templates-5a4488cb","title":"Backstage Scaffolder Backend remote code execution in v1beta3 templates","severity":"info","exploited":false,"published_at":"2021-12-01T18:29:12+00:00","url":"https://junglewise.ai/threats/backstage-scaffolder-backend-remote-code-execution-in-v1beta3-templates-5a4488cb"},{"cve":"CVE-2021-43783","cvss":3.1,"epss":0.0125,"slug":"cve-2021-43783-backstage-plugin-scaffolder-backend-path-traversal-in-fetch","title":"Backstage plugin-scaffolder-backend path traversal in fetch:template","severity":"low","exploited":false,"published_at":"2021-12-01T18:28:51+00:00","url":"https://junglewise.ai/threats/cve-2021-43783-backstage-plugin-scaffolder-backend-path-traversal-in-fetch"}],"vendor":{"hub":true,"name":"Backstage","slug":"backstage","homepage":"https://backstage.io","description":"An open platform for building developer portals and internal developer platforms.","url":"https://junglewise.ai/threats/vendors/backstage"},"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":2},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0}],"most_severe":[{"cve":"CVE-2026-88064","cvss":8.8,"epss":0.0088,"slug":"cve-2026-88064-backstage-techdocs-yaml-injection-in-mkdocs-configuration","title":"Backstage TechDocs YAML injection in mkdocs configuration","severity":"high","exploited":false,"published_at":"2026-09-16T15:18:04.297+00:00","url":"https://junglewise.ai/threats/cve-2026-88064-backstage-techdocs-yaml-injection-in-mkdocs-configuration"},{"cve":"CVE-2026-29186","cvss":7.7,"epss":0.0091,"slug":"cve-2026-29186-backstage-techdocs-arbitrary-code-execution-via-mkdocs","title":"Backstage TechDocs arbitrary code execution via MkDocs configuration bypass","severity":"high","exploited":false,"published_at":"2026-03-07T15:15:55.4+00:00","url":"https://junglewise.ai/threats/cve-2026-29186-backstage-techdocs-arbitrary-code-execution-via-mkdocs"},{"cve":"CVE-2026-25153","cvss":7.7,"epss":0.0058,"slug":"cve-2026-25153-backstage-techdocs-code-execution-via-mkdocs-hooks-configuration","title":"Backstage TechDocs code execution via MkDocs hooks configuration","severity":"high","exploited":false,"published_at":"2026-01-30T22:15:56.343+00:00","url":"https://junglewise.ai/threats/cve-2026-25153-backstage-techdocs-code-execution-via-mkdocs-hooks-configuration"},{"cve":"CVE-2026-24046","cvss":7.1,"epss":0.0053,"slug":"cve-2026-24046-backstage-scaffolder-symlink-path-traversal-in-multiple-actions","title":"Backstage Scaffolder symlink path traversal in multiple actions","severity":"high","exploited":false,"published_at":"2026-01-21T23:15:53.24+00:00","url":"https://junglewise.ai/threats/cve-2026-24046-backstage-scaffolder-symlink-path-traversal-in-multiple-actions"},{"cvss":4.7,"slug":"backstage-backstage-plugin-auth-backend-oauth-allowlist-bypass-fd6ff5e7","title":"Backstage @backstage/plugin-auth-backend OAuth allowlist bypass","severity":"medium","exploited":false,"published_at":"2026-07-24T16:20:59+00:00","url":"https://junglewise.ai/threats/backstage-backstage-plugin-auth-backend-oauth-allowlist-bypass-fd6ff5e7"},{"cve":"CVE-2026-44374","cvss":4.3,"epss":0.0028,"slug":"cve-2026-44374-backstage-incorrect-authorization-in-catalog-unprocessed-entities","title":"Backstage incorrect authorization in catalog unprocessed entities module","severity":"medium","exploited":false,"published_at":"2026-05-14T15:16:48.25+00:00","url":"https://junglewise.ai/threats/cve-2026-44374-backstage-incorrect-authorization-in-catalog-unprocessed-entities"},{"cve":"CVE-2026-32236","cvss":4,"epss":0.0047,"slug":"cve-2026-32236-backstage-auth-backend-ssrf-in-cimd-metadata-fetch","title":"Backstage auth-backend SSRF in CIMD metadata fetch","severity":"medium","exploited":false,"published_at":"2026-03-12T14:51:02+00:00","url":"https://junglewise.ai/threats/cve-2026-32236-backstage-auth-backend-ssrf-in-cimd-metadata-fetch"},{"cve":"CVE-2023-35926","cvss":3.1,"epss":0.0189,"slug":"cve-2023-35926-backstage-scaffolder-plugin-insecure-sandbox-in-code-execution","title":"Backstage Scaffolder plugin insecure sandbox in code execution","severity":"low","exploited":false,"published_at":"2023-06-21T22:00:30+00:00","url":"https://junglewise.ai/threats/cve-2023-35926-backstage-scaffolder-plugin-insecure-sandbox-in-code-execution"},{"cve":"CVE-2021-41151","cvss":3.1,"epss":0.0132,"slug":"cve-2021-41151-backstage-plugin-scaffolder-backend-path-traversal","title":"Backstage plugin-scaffolder-backend path traversal","severity":"low","exploited":false,"published_at":"2021-10-19T15:28:03+00:00","url":"https://junglewise.ai/threats/cve-2021-41151-backstage-plugin-scaffolder-backend-path-traversal"},{"cve":"CVE-2021-32662","cvss":3.1,"epss":0.0128,"slug":"cve-2021-32662-backstage-techdocs-path-traversal-in-mkdocs-yml","title":"Backstage TechDocs path traversal in mkdocs.yml","severity":"low","exploited":false,"published_at":"2021-06-04T19:09:20+00:00","url":"https://junglewise.ai/threats/cve-2021-32662-backstage-techdocs-path-traversal-in-mkdocs-yml"}],"generated_at":"2026-09-26T09:11:00.170868+00:00","technologies":[{"name":"Backstage Plugin-Auth-Backend","slug":"plugin-auth-backend","vulnerabilities":5,"url":"https://junglewise.ai/threats/technologies/plugin-auth-backend"},{"name":"Backstage Plugin-Scaffolder-Backend","slug":"plugin-scaffolder-backend","vulnerabilities":5,"url":"https://junglewise.ai/threats/technologies/plugin-scaffolder-backend"},{"name":"Backstage Scaffolder Backend Plugin","slug":"scaffolder-backend-plugin","vulnerabilities":3,"url":"https://junglewise.ai/threats/technologies/scaffolder-backend-plugin"},{"name":"Backstage TechDocs","slug":"techdocs","vulnerabilities":3,"url":"https://junglewise.ai/threats/technologies/techdocs"}]}