CVE Tools

Backstage

13 CVEs tracked since 2021. Since Jun 2021, none of them reached CISA KEV.

Backstage CVEs per month

Jun 2021 to Jan 2026. Point at a month, or focus the strip and use the arrow keys.
Backstage CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2021-0630
2021-07null or fewer
2021-08null or fewer
2021-09null or fewer
2021-10null or fewer
2021-1120
2021-12null or fewer
2022-01null or fewer
2022-02null or fewer
2022-03null or fewer
2022-04null or fewer
2022-05null or fewer
2022-06null or fewer
2022-07null or fewer
2022-08null or fewer
2022-09null or fewer
2022-10null or fewer
2022-11null or fewer
2022-12null or fewer
2023-01null or fewer
2023-02null or fewer
2023-03null or fewer
2023-04null or fewer
2023-05null or fewer
2023-06null or fewer
2023-07null or fewer
2023-08null or fewer
2023-09null or fewer
2023-10null or fewer
2023-11null or fewer
2023-12null or fewer
2024-01null or fewer
2024-02null or fewer
2024-03null or fewer
2024-04null or fewer
2024-05null or fewer
2024-06null or fewer
2024-07null or fewer
2024-08null or fewer
2024-0930
2024-10null or fewer
2024-11null or fewer
2024-12null or fewer
2025-01null or fewer
2025-02null or fewer
2025-03null or fewer
2025-04null or fewer
2025-05null or fewer
2025-06null or fewer
2025-07null or fewer
2025-08null or fewer
2025-09null or fewer
2025-10null or fewer
2025-11null or fewer
2025-12null or fewer
2026-0150

Products

The products that kept showing up in Backstage's monthly top three, with their CVEs summed over those months.

  1. Backstage134 months

Latest CVEs

The 15 most recently published vulnerabilities affecting Backstage.

  1. CVE-2026-88064Backstage: Improper input validation in TechDocs MkDocs configuration8.8
  2. CVE-2026-73563Backstage: Unauthenticated OAuth account takeover via `redirect_uri` allowlist bypass in `@backstage/plugin-auth-backend`4.7
  3. CVE-2026-44374Backstage: Catalog unprocessed read endpoints allow authenticated cross-owner data access without permission checks4.3
  4. CVE-2026-32237@backstage/plugin-scaffolder-backend: Possible exposure of defaultEnvironment secrets using dry-run endpoint4.4
  5. CVE-2026-32236@backstage/plugin-auth-backend: SSRF in experimental CIMD metadata fetch7.5
  6. CVE-2026-32235@backstage/plugin-auth-backend: OAuth redirect URI allowlist bypass5.9
  7. CVE-2026-29186@backstage/plugin-techdocs-node: TechDocs Mkdocs Configuration Key Enables Arbitrary Code Execution7.7
  8. CVE-2026-29184@backstage/plugin-scaffolder-backend: Potential Session Token Exfiltration via Log Redaction Bypass2.0
  9. CVE-2026-29185@backstage/integration: Potential reading of SCM URLs using built in token2.7
  10. CVE-2026-25152@backstage/plugin-techdocs-node vulnerable to possible Path Traversal in TechDocs Local Generator5.3
  11. CVE-2026-25153@backstage/plugin-techdocs-node vulnerable to arbitrary code execution via MkDocs hooks7.7
  12. CVE-2026-24048Backstage has a Possible SSRF when reading from allowed URL's in `backend.reading.allow`3.5
  13. CVE-2026-24047@backstage/cli-common has a possible `resolveSafeChildPath` Symlink Chain Bypass6.3
  14. CVE-2026-24046Backstage has a Possible Symlink Path Traversal in Scaffolder Actions7.1
  15. CVE-2025-55285@backstage/plugin-scaffolder-backend Template Secret Leakage in Logs in Scaffolder When Using `fetch:template`2.6

The record

Peak rank
#142 in Jun 2021
Busiest month shown
Jan 2026, 5 CVEs
Months with a KEV entry
0 since Jun 2021
Monthly snapshots
4 since 2021
Backstage's full record, month by month

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store