CVE-2026-115923
Description
A flaw was found in the Backstage plugin-catalog-backend component. This vulnerability allows an authenticated remote attacker with catalog location creation permissions to bypass catalog location rules and import untrusted content. By supplying URLs containing percent-encoded path segments, the attacker can satisfy trusted location rules against the raw URL while the service standardizes the path to retrieve content outside the permitted scope. Consequently, untrusted entity configurations are accepted as trusted, compromising catalog data integrity.
Statement
This vulnerability is rated as Moderate impact because exploitation requires authenticated network access with specific location registration privileges and does not directly result in host compromise or disclosure of sensitive data. In Red Hat Developer Hub deployments that enforce target location restrictions on catalog imports, an authenticated attacker can supply percent-encoded path sequences to evade prefix checks while accessing unpermitted repositories. The blast radius remains confined to catalog entity integrity and subsequent automated actions performed on the imported definitions.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
