CVE-2023-6944 Rhdh: catalog-import function leaks credentials to frontend
Attackers can view leaked GitLab access tokens in frontend error messages, enabling unauthorized repository access and code manipulation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-6944?
CVE-2023-6944 is a medium-severity vulnerability in Linuxfoundation Backstage, published on 4 Jan 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
A flaw was found in the Red Hat Developer Hub (RHDH). The catalog-import function leaks GitLab access tokens on the frontend when the base64 encoded GitLab token includes a newline at the end of the string. The sanitized error can display on the frontend, including the raw access token. Upon gaining access to this token and depending on permissions, an attacker could push malicious code to repositories, delete resources in Git, revoke or generate new keys, and sign code illegitimately.
Weakness: CWE-209
Which versions are affected by CVE-2023-6944?
2 open source packages ship an affected version, including @backstage/backend-app-api. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
@backstage/backend-app-api npm | All versions | 0.5.9-next.1 |
@backstage/backend-app-api npm | All versions | 0.5.9-next.1 |
Products include Linuxfoundation Backstage, Redhat Red Hat Developer Hub.
How do I fix CVE-2023-6944?
Upgrade @backstage/backend-app-api to 0.5.9-next.1 or later.
Is CVE-2023-6944 being exploited?
There is no known exploitation of CVE-2023-6944 in the wild and no public exploit code.
Other vulnerabilities in Linuxfoundation Backstage
- CVE-2026-106501 Backstage: Sensitive information exposure in Scaffolder
- CVE-2026-106558 Backstage: Improper validation of TechDocs MkDocs configuration
- CVE-2026-88064 Backstage: Improper input validation in TechDocs MkDocs configuration
- CVE-2026-106459 Backstage: Improper input validation in Sentry scaffolder actions
- CVE-2026-106486 Backstage: Improper filesystem validation in Bitbucket pull-request scaffolder actions
Sources
Also known as GHSA-86rg-pf4c-5grg.