CVE-2026-106561

Status: Undergoing AnalysisMedium (5)—

Backstage is an open framework for building developer portals. Prior to 0.21.9, the @backstage/plugin-kubernetes-backend package is affected by sensitive information disclosure in kubernetes resource queries. An authenticated user holding the standard Kubernetes resource read permission could retrieve sensitive values that the Kubernetes plugin is designed to mask, potentially exposing credentials and other confidential material held in the connected clusters. Exposure is limited to resources that the Backstage service account is permitted to read and that match the targeted catalog entity's namespace and label selector. Deployments whose cluster credentials do not grant read access to these resources are unaffected. This issue is fixed in version 0.21.9.

CVSS

Version: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Base score: 5

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days: 0.20%
Percentile among all scored CVEs: 9
Score date: 10/15/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

🎯 ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

ExploitationT1210 Exploitation of Remote Serviceslateral movement80 %
Primary impactT1552 Unsecured Credentialscredential access85 %
Secondary impactT1005 Data from Local Systemcollection75 %

Autenticado en red accede a servicio remoto (Kubernetes backend) para extraer secretos/credenciales enmascaradas (T1552) y datos sensibles de recursos permitidos (T1005). CWE-200 (información sensible) y CWE-863 (autorización débil) lo confirman.

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

🛡️ ATT&CK mitigations that cover these techniques

Privileged Account Management Update Software Active Directory Configuration Vulnerability Scanning User Training Threat Intelligence Program

Affected technologies (1)

⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.

Backstage — Plugin Kubernetes Backend^AI

CWEs

CWE-200, CWE-863

References

Raw JSON (NVD)

Show

{
  "id": "CVE-2026-106561",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-106561",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-10-07T15:26:59.491887Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.1
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "backstage",
          "product": "backstage",
          "versions": [
            {
              "status": "affected",
              "version": "< 1.54.2"
            }
          ]
        },
        {
          "vendor": "@backstage",
          "product": "plugin-kubernetes-backend",
          "versions": [
            {
              "status": "affected",
              "version": "< 0.21.9"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-10-07T15:17:17.490",
  "references": [
    {
      "url": "https://github.com/backstage/backstage/commit/388926ae5734bc20bd6a1520d02896be834f6527",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/backstage/backstage/releases/tag/v1.54.2",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/backstage/backstage/security/advisories/GHSA-p795-mqf2-36mf",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Undergoing Analysis",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        },
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Backstage is an open framework for building developer portals. Prior to 0.21.9, the @backstage/plugin-kubernetes-backend package is affected by sensitive information disclosure in kubernetes resource queries. An authenticated user holding the standard Kubernetes resource read permission could retrieve sensitive values that the Kubernetes plugin is designed to mask, potentially exposing credentials and other confidential material held in the connected clusters. Exposure is limited to resources that the Backstage service account is permitted to read and that match the targeted catalog entity's namespace and label selector. Deployments whose cluster credentials do not grant read access to these resources are unaffected. This issue is fixed in version 0.21.9."
    }
  ],
  "lastModified": "2026-10-07T17:16:51.197",
  "sourceIdentifier": "security-advisories@github.com"
}