CVE-2026-115923: CVE-2026-115923: Path Traversal and Catalog Rule Bypass in Backstage Catalog Backend

#security #cve #cybersecurity

CVE-2026-115923: Path Traversal and Catalog Rule Bypass in Backstage Catalog Backend

Vulnerability ID: CVE-2026-115923
CVSS Score: 6.5
Published: 2026-10-28

CVE-2026-115923 (GHSA-w658-mh9p-ww8f) is a path traversal and access control bypass vulnerability in Spotify's Backstage developer portal framework, specifically within the @backstage/plugin-catalog-backend package. Prior to patched versions, DefaultCatalogRulesEnforcer evaluated user-supplied URL catalog locations against configured catalog.rules patterns using raw, uncanonicalized strings. Because downstream URL readers canonicalize URLs and resolve dot segments before fetching resources, an authenticated attacker with location registration permissions can supply percent-encoded traversal sequences (such as %2e%2e) to bypass location restrictions and register untrusted catalog entities.

TL;DR

A parser discrepancy between Backstage's DefaultCatalogRulesEnforcer and downstream URL readers allows authenticated users with the catalog.location.create permission to bypass URL-based catalog rules via percent-encoded path traversal sequences. Upgrading @backstage/plugin-catalog-backend to version 3.9.2 or 4.0.2 resolves the issue by canonicalizing URLs prior to rule evaluation.

⚠️ Exploit Status: POC

Technical Details

Vulnerability Type: CWE-22: Path Traversal / Access Control Bypass
Affected Component: @backstage/plugin-catalog-backend (DefaultCatalogRulesEnforcer)
Attack Vector: Network (Authenticated REST API /api/catalog/locations)
CVSS v3.1 Score: 6.5 Medium (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
EPSS Score: 0.32% (24.60th Percentile)
Primary Impact: Bypass of catalog.rules location restrictions to register untrusted entities
Exploit Status: PoC (Verified in upstream unit test suite)
CISA KEV Status: Not Listed

Affected Systems

@backstage/plugin-catalog-backend
Spotify Backstage
@backstage/plugin-catalog-backend: < 3.9.2 (Fixed in: 3.9.2)
@backstage/plugin-catalog-backend: >= 4.0.0, < 4.0.2 (Fixed in: 4.0.2)
Backstage: < 1.54.10 (Fixed in: 1.54.10)
Backstage: >= 1.55.0, < 1.56.1 (Fixed in: 1.56.1)

Code Analysis

Commit: 3214dc8

Canonicalize URL location targets in DefaultCatalogRulesEnforcer before matching against catalog rules

Commit: 737ff1c

Release branch patch for URL canonicalization in DefaultCatalogRulesEnforcer

Mitigation Strategies

Upgrade @backstage/plugin-catalog-backend to version 3.9.2 or 4.0.2 (Backstage v1.54.10 or v1.56.1).
Restrict the catalog.location.create permission via the Backstage Permission Framework to trusted administrators or automated pipelines.
Deploy WAF or reverse proxy rules inspecting POST requests to /api/catalog/locations for encoded traversal sequences (%2e, %252e, %2f, %5c).
Audit existing Location entities in the catalog database for targets containing encoded dot segments or userinfo prefixes.

Remediation Steps:

Update package.json dependencies to reference @backstage/plugin-catalog-backend >= 3.9.2 (for v3.x) or >= 4.0.2 (for v4.x), or run 'yarn backstage-cli versions:bump' to upgrade to Backstage v1.54.10 / v1.56.1.
Review catalog.rules in app-config.yaml to verify that URL patterns and exact match strings do not rely on uncanonicalized syntax or explicit default ports (:80, :443).
Query the catalog database (locations table) for any previously registered URL targets containing '..', '%2e', '%2f', '%5c', or '@' to identify potential prior exploitation.
Rebuild and redeploy the Backstage backend service.

References

Read the full report for CVE-2026-115923 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community