BA
Product
backend-defaults
by @backstage · last CVE Oct 12, 2026
3
CVEs
0
On KEV
6.5
Max CVSS
3
New 30D
Severity mix
Critical 0High 0Medium 3Low 0
Watch

Add backend-defaults to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-106492
6.5
0%
Oct 6
Backstage: Improper preservation of access restrictions during service credential delegation
Affected: < 0.16.1; >= 0.17.0, < 0.17.8
CVE-2026-106494
4.9
0%
Oct 6
Backstage: Improper input validation in cloud storage URL readers
Affected: < 0.17.8
CVE-2026-106495
4.3
0%
Oct 12
Backstage: Improper access control in backend action invocation
Affected: < 0.17.8
Showing 3