Backstage @backstage/plugin-kubernetes-backend CVE-2026-106561 Sensitive Information Disclosure

Vulnerability Overview A sensitive information disclosure vulnerability has been identified in Kubernetes resource queries. Specifically, authenticated users with standard Kubernetes resource read permissions may retrieve sensitive values that should have been masked by the Kubernetes plugin, potentially exposing credentials and other confidential materials. Affected Versions Affected versions: < 0.21.9 Fixed version: 0.21.9 Remediation Patch: The issue was resolved in version 0.21.9. Workarounds: - Enable the permissions framework and restrict permissions to trusted users. - Adjust the RBAC (Role-Based Access Control) of the service account to allow access only to necessary resources, avoiding the reading of sensitive resource types. The recommended does not grant this access, as detailed in the Kubernetes plugin configuration documentation. References Kubernetes Plugin Configuration, including Role-Based Access Control Backstage Permissions Overview Backstage Threat Model Additional Information CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Changed - Confidentiality: Low - Integrity: None - Availability: None CVSS v3 Vector String: CVE ID: CVE-2026-106561 Weaknesses: - CWE-200 - CWE-863 Summary This vulnerability involves sensitive information disclosure in Kubernetes resource queries. It affects versions prior to 0.21.9, with version 0.21.9 providing the fix. Users are advised to upgrade to the fixed version as soon as possible or implement the appropriate workarounds.

Goal Reached Thanks to every supporter — we hit 100%!

Backstage @backstage/plugin-kubernetes-backend CVE-2026-106561 Sensitive Information Disclosure

More from this source