CVE-2026-106561: @backstage/plugin-kubernetes-backend Sensitive Information Disclosure in Kubernetes Resource Queries
Summary
CVE-2026-106561: Backstage has a sensitive information disclosure in Kubernetes resource queries. Affects @backstage/plugin-kubernetes-backend versions < 0.21.9. Fixed in 0.21.9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @backstage/plugin-kubernetes-backend package is a plugin for Backstage that facilitates interaction with Kubernetes clusters. It allows users to query and manage Kubernetes resources seamlessly. However, due to a vulnerability, sensitive information that should be masked can be exposed to authenticated users with standard read permissions, potentially leading to unauthorized access to confidential data.
Vulnerability Detail
The vulnerability arises from the improper handling of sensitive data in Kubernetes resource queries. Authenticated users with standard read permissions can retrieve sensitive values that the plugin is designed to mask, such as credentials and other confidential material. This exposure is limited to resources that the Backstage service account can read and that match the targeted catalog entity's namespace and label selector. Deployments where cluster credentials do not allow read access to these resources remain unaffected.
How To Fix
Minimum fixed version
0.21.9
This is the first release that contains the fix.
npm install @backstage/plugin-kubernetes-backend@0.21.9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, enable the permission framework and restrict the kubernetes.resources.read permission to trusted users. Additionally, scope the RBAC of the service account used to access each cluster to prevent reading sensitive resource types. For example, you can define a ClusterRole that does not grant access to sensitive resources.
Conclusion
The CVE-2026-106561 vulnerability in the @backstage/plugin-kubernetes-backend package poses a risk of sensitive information disclosure. It is crucial for users to update to the patched version and implement recommended workarounds to mitigate potential risks.
See every vulnerability recorded for @backstage/plugin-kubernetes-backend →
FAQ
CVE-2026-106561 is a vulnerability in the @backstage/plugin-kubernetes-backend package that allows authenticated users to access sensitive information in Kubernetes resource queries.
Any authenticated user with standard Kubernetes resource read permissions could potentially exploit this vulnerability if they have access to the affected resources.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Update the @backstage/plugin-kubernetes-backend package to version 0.21.9 or later, and consider implementing RBAC restrictions to limit access to sensitive resources.
The CVSS score of this vulnerability is 5.0, indicating a moderate level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for @backstage/plugin-kubernetes-backend.
