CVE-2026-29185 @backstage/integration: Potential reading of SCM URLs using built in token
Attackers can use path traversal in SCM URLs to access unintended API endpoints using server-side credentials, potentially reading sensitive data.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-29185?
CVE-2026-29185 is a low-severity path traversal vulnerability in backstage, published on 7 Mar 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Backstage is an open framework for building developer portals. Prior to version 1.20.1, a vulnerability in the SCM URL parsing used by Backstage integrations allowed path traversal sequences in encoded form to be included in file paths. When these URLs were processed by integration functions that construct API URLs, the traversal segments could redirect requests to unintended SCM provider API endpoints using the configured server-side integration credentials. This issue has been patched in version 1.20.1.
Weakness: CWE-22
Which versions are affected by CVE-2026-29185?
2 open source packages ship an affected version, including @backstage/integration. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@backstage/integration npm | All versions | 1.20.1 |
@backstage/integration npm | All versions | 1.20.1 |
Products include Linuxfoundation Backstage\/Integration.
How do I fix CVE-2026-29185?
Upgrade @backstage/integration to 1.20.1 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-29185 being exploited?
There is no known exploitation of CVE-2026-29185 in the wild and no public exploit code.
Sources
Also known as GHSA-95v5-prp4-5gv5.