CVE-2026-106563: 
JavaScript vulnerability analysis and mitigation

CVE-2026-106563 is an authorization bypass vulnerability in the @backstage/plugin-kubernetes-backend npm package affecting Backstage, the open-source developer portal framework. Due to improper entity validation in a deprecated Kubernetes services endpoint (/services/:serviceId), an authenticated user with Kubernetes read permissions can access Kubernetes workload data beyond their intended scope by supplying crafted entity data. Affected versions are @backstage/plugin-kubernetes-backend prior to 0.21.8 and Backstage prior to v1.54.1. It carries a CVSS v3.1 base score of 5.3 (Medium) (Github Advisory, Backstage Advisory).

The root cause is a combination of improper input validation (CWE-20) and missing authorization (CWE-862) in the deprecated /services/:serviceId route of KubernetesRouter.ts. Prior to the fix, the endpoint accepted a caller-supplied entity object in the POST request body without verifying that the entity actually existed in the Backstage catalog or that the caller was authorized to access it. The patch resolves this by parsing the entity reference, looking it up in the catalog using the caller's credentials, and rejecting requests where the entity is not found (returning HTTP 403). An attacker must be authenticated and hold the kubernetes.resources.read permission, but can then craft an arbitrary entity reference to query Kubernetes object metadata across any configured cluster (Backstage Advisory, Patch Commit).

Successful exploitation allows an authenticated attacker to read Kubernetes object metadata (workload data) across all clusters configured in the Backstage instance, beyond the scope they are authorized to access. The impact is limited to confidentiality — there is no integrity or availability impact, and no write access is granted. Sensitive information such as pod names, namespaces, labels, annotations, and other Kubernetes resource metadata from unauthorized clusters could be exposed, potentially aiding further reconnaissance or lateral movement within a Kubernetes environment (Github Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Github Advisory). The EPSS score is 0.0, indicating very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authentication and the kubernetes.resources.read permission, which raises the bar for opportunistic attackers, though insider threats or compromised accounts remain a concern.

1. Authenticate: Obtain valid Backstage credentials for an account that holds the kubernetes.resources.read permission.
2. Identify the deprecated endpoint: Confirm the target Backstage instance exposes the deprecated /api/kubernetes/services/:serviceId POST endpoint (present in @backstage/plugin-kubernetes-backend < 0.21.8).
3. Craft a malicious request: Construct a POST request to /api/kubernetes/services/<any-service-id> with a JSON body containing a crafted entity object referencing an entity the attacker is not authorized to access, e.g.:

{
  "entity": {
    "kind": "Component",
    "metadata": { "name": "target-service", "namespace": "production" }
  }
}

4. Retrieve unauthorized metadata: The server, lacking catalog-based entity validation, processes the crafted entity and returns Kubernetes workload metadata (pods, deployments, etc.) from configured clusters associated with the specified entity, bypassing intended access controls.
5. Enumerate clusters: Repeat with different entity references to enumerate Kubernetes object metadata across all clusters configured in the Backstage instance (Backstage Advisory, Patch Commit).

• Network: Unusual or repeated POST requests to /api/kubernetes/services/<serviceId> from authenticated users, especially with entity references that do not correspond to entities the user normally accesses.
• Logs: Backstage backend access logs showing POST requests to the deprecated /services/:serviceId endpoint with entity bodies referencing namespaces or components outside the user's normal scope; after patching, HTTP 403 responses with the message Entity not found for crafted entity references.
• Behavioral: A single authenticated user querying many different entity references or namespaces via the Kubernetes services endpoint in a short time window, suggesting enumeration activity.

Upgrade @backstage/plugin-kubernetes-backend to version 0.21.8 or later, or upgrade the Backstage monorepo to v1.54.1 or later, which includes the fix (Backstage Release). If immediate patching is not possible, two workarounds are available: (1) disable the deprecated /services/:serviceId route by deploying a custom Kubernetes router that omits it, or (2) restrict the kubernetes.resources.read permission to a minimal set of trusted users to reduce the attack surface (Github Advisory).