CVE-2026-29185: Backstage SCM Integration Path Traversal Vulnerability
Summary
CVE-2026-29185: Backstage vulnerable to potential reading of SCM URLs using built in token. Affects @backstage/integration versions < 1.20.1. Fixed in 1.20.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @backstage/integration package is a vital component of the Backstage framework, facilitating seamless integration with various Source Code Management (SCM) systems such as GitHub, Bitbucket Server, and Bitbucket Cloud. It allows developers to scaffold applications and manage integrations effectively. However, a vulnerability has been identified that compromises the security of SCM URL parsing, potentially leading to unauthorized access to sensitive API endpoints.
Vulnerability Detail
A vulnerability in the SCM URL parsing mechanism of the @backstage/integration package allows for path traversal sequences in encoded form to be included in file paths. This flaw can be exploited by attackers to redirect requests to unintended SCM provider API endpoints using the server-side integration credentials configured in the application. This issue primarily affects instances utilizing SCM integrations with user-provided URLs, posing a risk of unauthorized data access and manipulation.
How To Fix
Latest published version: 2.1.3 as of 23 Oct 2026
npm install @backstage/integration@2.1.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.20.1
This is the first release that contains the fix.
npm install @backstage/integration@1.20.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no workarounds available for this vulnerability. The only effective solution is to upgrade to the patched version of the package.
Conclusion
The CVE-2026-29185 vulnerability in the @backstage/integration package poses a significant risk to applications using SCM integrations. It is essential to upgrade to version 1.20.1 or later to mitigate this issue and protect sensitive data from unauthorized access.
See every vulnerability recorded for @backstage/integration →
FAQ
CVE-2026-29185 is a vulnerability in the @backstage/integration package that allows for path traversal in SCM URL parsing, potentially leading to unauthorized access to API endpoints.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Unfortunately, there are no workarounds available for this vulnerability. It is crucial to upgrade to the patched version as soon as possible.
The CVSS score of this vulnerability is 2.7, indicating a low severity level.
You can refer to the Backstage SCM integration documentation at https://backstage.io/docs/integrations/ for more details.
