Bug 2547202 (CVE-2026-106493) - CVE-2026-106493 backstage: Backstage: Information disclosure via improper object path validation in cloud storage catalog providers
Summary: CVE-2026-106493 backstage: Backstage: Information disclosure via improper obj...
Keywords:
Status: NEW
Alias: CVE-2026-106493
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-10-06 21:02 UTC by OSIDB Bzimport
Modified: 2026-10-07 04:40 UTC (History)
16 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-10-06 21:02:12 UTC 
Backstage is an open framework for building developer portals. Prior to 1.54.6, cloud storage catalog providers did not sufficiently validate object paths. A principal able to create or rename objects in a configured Azure Blob Storage or AWS S3 catalog source could cause catalog descriptors to be read from outside the intended storage boundary, limited to locations reachable with the backend's configured credentials. This issue is fixed in 1.54.6.
Note You need to log in before you can comment on or make changes to this bug.