{"items":[{"id":"NVI-00011826","kind":"vulnerability","title":"Backstage has a sensitive information disclosure in Kubernetes resource queries","revision":3,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-p795-mqf2-36mf","CVE-2026-106561"],"plain_summary":"GitHub lists this reviewed advisory for @backstage/plugin-kubernetes-backend. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-9b4018e432a1211dea7f9464faaa1f53"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-07T18:02:35.000Z","value":"5 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-3bd1453afb55df6b5c1e0614dcf3a524"},{"kind":"CVSS","as_of":"2026-10-16T14:55:13.473Z","value":"5 MEDIUM (3.1)","meaning":"security-advisories@github.com severity; no combined Null risk score.","source_id":"sr-7d31691e04d0ec9b1cf01eb7cf2f5263"},{"kind":"EPSS","as_of":"2026-10-31T12:00:27.000Z","value":"0.197%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.09483. Missing scores are unknown.","source_id":"sr-9b4018e432a1211dea7f9464faaa1f53"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-3bd1453afb55df6b5c1e0614dcf3a524","url":"https://github.com/advisories/GHSA-p795-mqf2-36mf","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-p795-mqf2-36mf","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T00:58:46.232Z"},{"id":"sr-7d31691e04d0ec9b1cf01eb7cf2f5263","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106561","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2026-106561","publisher":"NIST National Vulnerability Database","observed_at":"2026-11-03T09:58:21.903Z"},{"id":"sr-9b4018e432a1211dea7f9464faaa1f53","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-106561","publisher":"FIRST EPSS","observed_at":"2026-11-01T01:39:43.064Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-3bd1453afb55df6b5c1e0614dcf3a524"],"technology":"@backstage/plugin-kubernetes-backend","known_exclusions":[],"conditions_summary":"### Impact\n\nAn authenticated user holding the standard Kubernetes resource read permission could retrieve sensitive values that the Kubernetes plugin is designed to mask, potentially exposing credentials and other confidential material held in the connected clusters. Exposure is limited to resources that the Backstage service account is permitted to read and that match the targeted catalog entity's namespace and label selector. Deployments whose cluster credentials do not grant read access to these resources are unaffected.\n\n### Patches\n\nFixed in @backstage/plugin-kubernetes-backend version 0.21.9 \n\nOne behavior change is worth noting for adopters who expose custom resources: a custom resource whose list kind is reported by the API server as SecretList now has the values of its data field masked, matching how core Kubernetes Secrets have always been handled on other query paths.\n\n### Workarounds\n\n- Enable the permission framework and restrict `kubernetes.resources.read` to trusted users.\n- Scope the RBAC of the service account used to reach each cluster so that it cannot read sensitive resource types. The recommended `ClusterRole` in the Kubernetes plugin configuration documentatio","public_affected_ranges":["< 0.21.9"]}],"null_published_at":"2026-11-08T15:11:49.375Z","source_updated_at":"2026-10-07T18:02:35.000Z","source_disclosed_at":"2026-10-07T18:02:30.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-11-01T00:58:46.232Z"},{"id":"NVI-00011826","kind":"vulnerability","title":"Backstage has a sensitive information disclosure in Kubernetes resource queries","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-p795-mqf2-36mf","CVE-2026-106561"],"plain_summary":"GitHub lists this reviewed advisory for @backstage/plugin-kubernetes-backend. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-9b4018e432a1211dea7f9464faaa1f53"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-07T18:02:35.000Z","value":"5 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-3bd1453afb55df6b5c1e0614dcf3a524"},{"kind":"EPSS","as_of":"2026-10-31T12:00:27.000Z","value":"0.197%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.09483. Missing scores are unknown.","source_id":"sr-9b4018e432a1211dea7f9464faaa1f53"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-3bd1453afb55df6b5c1e0614dcf3a524","url":"https://github.com/advisories/GHSA-p795-mqf2-36mf","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-p795-mqf2-36mf","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T00:58:46.232Z"},{"id":"sr-9b4018e432a1211dea7f9464faaa1f53","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-106561","publisher":"FIRST EPSS","observed_at":"2026-11-01T01:39:43.064Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-3bd1453afb55df6b5c1e0614dcf3a524"],"technology":"@backstage/plugin-kubernetes-backend","known_exclusions":[],"conditions_summary":"### Impact\n\nAn authenticated user holding the standard Kubernetes resource read permission could retrieve sensitive values that the Kubernetes plugin is designed to mask, potentially exposing credentials and other confidential material held in the connected clusters. Exposure is limited to resources that the Backstage service account is permitted to read and that match the targeted catalog entity's namespace and label selector. Deployments whose cluster credentials do not grant read access to these resources are unaffected.\n\n### Patches\n\nFixed in @backstage/plugin-kubernetes-backend version 0.21.9 \n\nOne behavior change is worth noting for adopters who expose custom resources: a custom resource whose list kind is reported by the API server as SecretList now has the values of its data field masked, matching how core Kubernetes Secrets have always been handled on other query paths.\n\n### Workarounds\n\n- Enable the permission framework and restrict `kubernetes.resources.read` to trusted users.\n- Scope the RBAC of the service account used to reach each cluster so that it cannot read sensitive resource types. The recommended `ClusterRole` in the Kubernetes plugin configuration documentatio","public_affected_ranges":["< 0.21.9"]}],"null_published_at":"2026-11-05T03:53:06.259Z","source_updated_at":"2026-10-07T18:02:35.000Z","source_disclosed_at":"2026-10-07T18:02:30.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-11-01T00:58:46.232Z"},{"id":"NVI-00011826","kind":"vulnerability","title":"Backstage has a sensitive information disclosure in Kubernetes resource queries","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-p795-mqf2-36mf","CVE-2026-106561"],"plain_summary":"GitHub lists this reviewed advisory for @backstage/plugin-kubernetes-backend. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-3bd1453afb55df6b5c1e0614dcf3a524"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-07T18:02:35.000Z","value":"5 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-3bd1453afb55df6b5c1e0614dcf3a524"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-3bd1453afb55df6b5c1e0614dcf3a524","url":"https://github.com/advisories/GHSA-p795-mqf2-36mf","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-p795-mqf2-36mf","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T00:58:46.232Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-3bd1453afb55df6b5c1e0614dcf3a524"],"technology":"@backstage/plugin-kubernetes-backend","known_exclusions":[],"conditions_summary":"### Impact\n\nAn authenticated user holding the standard Kubernetes resource read permission could retrieve sensitive values that the Kubernetes plugin is designed to mask, potentially exposing credentials and other confidential material held in the connected clusters. Exposure is limited to resources that the Backstage service account is permitted to read and that match the targeted catalog entity's namespace and label selector. Deployments whose cluster credentials do not grant read access to these resources are unaffected.\n\n### Patches\n\nFixed in @backstage/plugin-kubernetes-backend version 0.21.9 \n\nOne behavior change is worth noting for adopters who expose custom resources: a custom resource whose list kind is reported by the API server as SecretList now has the values of its data field masked, matching how core Kubernetes Secrets have always been handled on other query paths.\n\n### Workarounds\n\n- Enable the permission framework and restrict `kubernetes.resources.read` to trusted users.\n- Scope the RBAC of the service account used to reach each cluster so that it cannot read sensitive resource types. The recommended `ClusterRole` in the Kubernetes plugin configuration documentatio","public_affected_ranges":["< 0.21.9"]}],"null_published_at":"2026-11-01T01:03:56.608Z","source_updated_at":"2026-10-07T18:02:35.000Z","source_disclosed_at":"2026-10-07T18:02:30.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-01T00:58:46.232Z"}],"next_cursor":null,"snapshot_revision":"42594"}