CVE-2026-106563
Description
A flaw was found in the Backstage Kubernetes backend plugin (@backstage/plugin-kubernetes-backend). Due to improper entity validation in a deprecated services endpoint, an authenticated user with read permissions can submit crafted entity data. This issue allows unauthorized information disclosure, granting the user read-only access to Kubernetes workload metadata across configured clusters beyond their intended scope.
Statement
A MODERATE severity information disclosure flaw was found in the Backstage Kubernetes backend plugin (@backstage/plugin-kubernetes-backend), which is shipped in Red Hat Developer Hub and in the automation portal of Red Hat Ansible Automation Platform. The deprecated Kubernetes services endpoint performs improper entity validation: an authenticated user with Kubernetes read permissions can supply crafted entity data to that endpoint and obtain read-only access to Kubernetes workload object metadata across configured clusters, beyond their intended scope. The exposure is limited to reading Kubernetes object metadata; data cannot be modified and service availability is not affected. The Red Hat severity assessment (MODERATE, CVSS 3.1 score 5.3, CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) matches the upstream assessment, so there is no meaningful difference from upstream severity. The affected Red Hat products are marked AFFECTED with the fix deferred, because the impact is moderate with a CVSS score below 7.0 and no update is currently planned for these streams. The residual risk of deferring the fix is that an authenticated user with Kubernetes read permissions can view Kubernetes object metadata beyond their intended scope across configured clusters.
Mitigation
Workarounds are available for this issue. The deprecated /services/:serviceId route can be disabled by deploying a custom Kubernetes router that omits it. Additionally, access to the kubernetes.resources.read permission can be restricted so that only the necessary users can reach the affected endpoint, which limits the set of authenticated users able to query Kubernetes data. The upstream project has fixed this issue in a later release of the plugin; a fix for the affected Red Hat products is currently deferred, so no Red Hat update version is available at this time.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.3 | 6.5 | 5.3 |
| Attack Vector | Network | Network | Network |
| Attack Complexity | High | Low | High |
| Privileges Required | Low | Low | Low |
| User Interaction | None | None | None |
| Scope | Unchanged | Unchanged | Unchanged |
| Confidentiality | High | High | High |
| Integrity Impact | None | None | None |
| Availability Impact | None | None | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
cve.org: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism
Access control checks for specific user data or functionality can be bypassed.
Access Control
Technical Impact: Gain Privileges or Assume Identity
Horizontal escalation of privilege is possible (one user can view/modify information of another user).
Access Control
Technical Impact: Gain Privileges or Assume Identity
Vertical escalation of privilege is possible if the user-controlled key is actually a flag that indicates administrator status, allowing the attacker to gain administrative access.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
