CVE-2026-106496

Executive Summary

CVE-2026-106496 is a path traversal / improper access control vulnerability (CWE-22) in the @backstage/plugin-catalog-backend package of Backstage, an open-source framework for building developer portals. Prior to version 3.9.1, the catalog backend inconsistently enforced allowed location types during catalog processing, allowing processing of location types that should not have been permitted and potentially enabling unintended file access on the backend host. The vulnerability carries a CVSS v3.1 base score of 3.1 (Low severity) and affects deployments where the catalog backend processes user-influenced location definitions.

Technical Analysis

Backstage's catalog backend is responsible for ingesting, processing, and maintaining a graph of software components, APIs, and other entities defined in "locations." Catalog locations support multiple types — for example, local filesystem paths, Git URLs, and other source schemes — and administrators are expected to be able to constrain which location types are permitted via configuration. The vulnerability described in NVD is an inconsistent enforcement of those allowed location types: under certain configurations, the catalog backend could process location types that were not intended to be allowed.

This is a classic control-inconsistency flaw. The security boundary here is the administrator-configured allow-list of location types. When enforcement of that allow-list is not applied uniformly across all code paths that resolve or process locations, an attacker who can supply or influence a location definition may cause the backend to handle a location type that policy intended to block. Because location types can reference filesystem paths, the downstream consequence is potential unintended file access on the backend host — i.e., a path-traversal-style read of files the operator did not intend the catalog processing pipeline to reach.

Key characteristics from the advisory:

• Vulnerability class: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory — "Path Traversal"), applied at the level of location-type enforcement rather than a single string-sanitization function.
• Attack surface: The catalog processing pipeline within @backstage/plugin-catalog-backend. The flaw is triggered through the type of location that the backend is willing to process, not necessarily through a raw user input string.
• Preconditions: Non-default or specific configurations ("under certain configurations") and the ability to cause disallowed location types to be processed. CVSS reflects this: AV:N (network reachable), AC:H (High attack complexity — requires specific configuration conditions), PR:L (Low privileges — some authenticated ability to influence catalog input), UI:N (no user interaction).
• Impact subscores: C:N / I:L / A:N — no confidentiality impact is scored, low integrity impact, no availability impact. This low-impact profile is consistent with the advisory language of "potentially" leading to unintended file access and the requirement for specific configurations.

Insufficient technical detail available in the advisory regarding the exact code path, the precise list of location types, or the exact configuration flag involved. The report deliberately does not fabricate function names, endpoints, or configuration keys beyond what the NVD description states.

Exploitation Scenarios

No public PoC or exploit code is available (POC_STATUS: None; no ExploitDB, GitHub PoC, or Nuclei template identified). The following attack chain is inferred strictly from the vulnerability class (CWE-22 via inconsistent location-type enforcement) and the CVSS vector; it does not assert implementation details not present in the advisory.

1. Reconnaissance / target identification. An attacker identifies a Backstage deployment exposing the catalog backend (typically a developer portal reachable over the network, AV:N). They enumerate whether the deployment accepts catalog location definitions from semi-trusted sources — for example, catalog entities or location references submitted by an authenticated user (PR:L). The attacker maps which location types the operator appears to permit.

2. Triggering the flaw (vulnerability class level). The attacker supplies a catalog location definition that references a location type the operator did not intend to allow. Because enforcement of allowed location types is inconsistent across catalog processing paths, the malicious or disallowed location type is processed anyway, instead of being rejected. The High attack complexity (AC:H) reflects that this depends on specific configuration states for the flaw to be reachable.

3. Payload / execution method (class level). The disallowed location type resolves to a filesystem reference on the backend host. Processing that location causes the catalog backend to read or otherwise access a file that should have been excluded by the location-type allow-list — a path-traversal-style access to resources outside the intended processing scope. No public payload is known; the specific traversal string or location-type value is not published.

4. Post-exploitation impact. Consistent with CVSS (I:L, C:N, A:N), impact is limited: low integrity impact to catalog data and, per the advisory, potential unintended file access on the backend host. This is not scored as a confidentiality breach in the CVSS vector, and there is no availability impact. The primary risk is that unvetted backend-host content can influence catalog processing.

Impact Assessment

• CVSS v3.1 base score: 3.1 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N.
• Exploitability: Network-reachable but High complexity and requiring Low privileges. Exploitation is not trivial and depends on specific backend configurations.
• Impact subscores: No confidentiality impact (C:N), Low integrity impact (I:L), No availability impact (A:N). The flaw's primary effect is integrity of the catalog and potential unintended backend file access, not a guaranteed data exfiltration.
• Affected systems: Any deployment running @backstage/plugin-catalog-backend prior to 3.9.1, particularly those that ingest catalog locations from users or teams the operator does not fully trust, or that rely on location-type allow-lists as a security control.
• Blast radius: The catalog backend is a central service in a Backstage developer portal. If attackers can influence locations processed by it, catalog integrity and any data reachable through backend-host file processing are at risk. However, the Low CVSS score and lack of scored confidentiality impact bound the expected blast radius.
• CISA KEV: Not listed. EPSS: Not yet scored by FIRST.org (no value fabricated).

Detection Guidance

Backstage catalog backend activity is primarily HTTP/JSON API traffic. The detection rules below focus on anomalous catalog location ingestion, path-traversal indicators in location references, and bulk/suspicious catalog entity operations. These are heuristic because no public PoC identifies exact payload strings.

Sigma Rule

title: Suspicious Backstage Catalog Location Type or Path Traversal Attempt (CVE-2026-106496)
id: 7f3c9a21-2b6e-4d5a-9e10-1c8b4a7d9f22
status: experimental
description: Detects catalog location references containing path traversal sequences or unexpected location type schemes targeting the Backstage catalog backend, associated with inconsistent allowed-location-type enforcement (CVE-2026-106496).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-106496
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: backstage
detection:
  selection_endpoint:
    cs-uri-stem|contains:
      - '/api/catalog/'
      - '/entities'
      - '/locations'
  selection_traversal:
    cs-uri-query|contains:
      - '../'
      - '..%2f'
      - '..%5c'
      - '%2e%2e%2f'
      - 'file://'
  selection_locationtype:
    cs-uri-query|contains:
      - 'type=file'
      - 'type=url'
  condition: selection_endpoint and (selection_traversal or selection_locationtype)
fields:
  - c-ip
  - cs-uri-stem
  - cs-uri-query
  - cs-User-Agent
falsepositives:
  - Legitimate administrators configuring local file locations
level: medium

YARA Rule

rule CVE_2026_106496_Backstage_Catalog_PathTraversal
{
    meta:
        description = "Detects path traversal / disallowed location type indicators in Backstage catalog request payloads or logs (CVE-2026-106496)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-106496"
        author = "valtersit.com"
        date = "2026-01-01"
        severity = "low"

    strings:
        $cat = "plugin-catalog-backend" ascii nocase
        $api = "/api/catalog/" ascii
        $loc = "location" ascii nocase
        $trav1 = "../../" ascii
        $trav2 = "..\\..\\" ascii
        $trav3 = "%2e%2e%2f" ascii nocase
        $scheme = "file://" ascii nocase
        $allow = "allowedLocationTypes" ascii nocase

    condition:
        (uint16(0) == 0x0a0d or true) and
        (
            ($cat and $api) or
            ($api and $loc) or
            ($loc and $allow) or
            ($api and ($trav1 or $trav2 or $trav3 or $scheme))
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-106496 Backstage Catalog Location-Type Path Traversal Attempt"; flow:established,to_server; http.uri; content:"/api/catalog/"; http.uri; content:"..%2f"; nocase; distance:0; sid:2026106496; rev:1; reference:cve,2026-106496; classtype:attempted-recon; metadata:affected_product Backstage, created_at 2026_01_01, cve CVE_2026_106496;)

Elastic Detection

sequence by source.ip with maxspan=1m
  [ network where network.protocol == "http" and
      url.path : ("*catalog*" or "*location*") and
      url.query : ("*..%2f*" or "*../*" or "*file://*") ]
  [ network where network.protocol == "http" and
      url.path : ("*entities*" or "*locations*") ]

Splunk SPL Query

index=web OR index=backstage sourcetype=access_combined OR sourcetype=backstage:api
| search uri_path IN ("/api/catalog/*", "*entities*", "*locations*")
| eval traversal=if(match(uri_query, "\.\./|\.\.%2f|%2e%2e%2f|file://"), 1, 0)
| eval locType=if(match(uri_query, "type=(file|url)"), 1, 0)
| where traversal=1 OR locType=1
| stats count min(_time) as first_seen max(_time) as last_seen values(uri_path) as paths values(uri_query) as queries by src_ip
| where count > 1
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="backstage,cve-2026-106496,">
  <rule id="1064961" level="7">
    <decoded_as>json</decoded_as>
    <field name="url.path">/api/catalog/</field>
    <field name="url.query">..%2f|../|file://</field>
    <description>CVE-2026-106496: Backstage catalog location-type path traversal attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_106496,path_traversal,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source in the provided data). No vendor workaround is listed.

1. Immediate mitigations

   • Restrict network exposure of the Backstage catalog backend API to trusted internal networks; do not expose it directly to the internet (aligns with reducing the AV:N surface).
   • Tighten catalog location configuration: explicitly allow-list only required location types and avoid configurations that permit processing of types intended to be blocked.
   • Limit the set of actors permitted to submit or influence catalog location definitions (PR:L in the vector — require authentication and least privilege).
   • Monitor catalog ingress logs for traversal indicators and unexpected location types using the detection guidance above.

2. Patch / upgrade steps

   • Upgrade @backstage/plugin-catalog-backend to version 3.9.1 or later, which the advisory states fixes the issue. Validate the dependency resolution across the monorepo and lockfile after upgrade.
   • Re-audit catalog location allow-list configuration after upgrade to confirm consistent enforcement.

3. Long-term hardening

   • Enforce location-type allow-lists at a single, centralized validation point rather than multiple inconsistent code paths.
   • Sandbox or constrain filesystem access for the catalog backend process (least-privilege service account, container filesystem read-only where feasible).
   • Adopt dependency tracking for Backstage packages and subscribe to the vendor's security advisories and release notes for @backstage/plugin-catalog-backend.

References

• NVD — CVE-2026-106496: https://nvd.nist.gov/vuln/detail/CVE-2026-106496
• Backstage (Backstage project) — official repository and security advisories for @backstage/plugin-catalog-backend: https://github.com/backstage/backstage/security/advisories
• Backstage documentation — catalog and location configuration guidance: https://backstage.io/docs/
• MITRE CWE-22 — Improper Limitation of a Pathname to a Restricted Directory (Path Traversal): https://cwe.mitre.org/data/definitions/22.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/

Threat actor campaigns / exploit-in-the-wild: None identified. CISA KEV: No. No public PoC, Nuclei template, or exploit code is available for this CVE at the time of writing.