Backstage catalog rules can be bypassed for URL locations using encoded path segments

影響: npm:@backstage/plugin-catalog-backend < 3.9.2 → 3.9.2, npm:@backstage/plugin-catalog-backend >= 4.0.0, < 4.0.2 → 4.0.2

@backstage/plugin-catalog-backend matches URL-type locations against catalog.rules location patterns using the raw URL string submitted by the user, while URL readers resolve that same string in canonical form when fetching the location's content. A URL can therefore be crafted so that it appears to belong to a trusted location scope during rule evaluation, but is fetched from a different scope. Details When a deployment restricts catalog kinds to trusted URL prefixes using catalog.rules locati…

Read on GitHub Advisory Database

On 10/29/2026, 07:42 AM, GitHub Advisory Database published "Backstage catalog rules can be bypassed for URL locations using encoded path segments" (type: Advisory). Severity is "Medium" (medium). Related technologies: JavaScript / Node.js. CVE: CVE-2026-115923.