CVE-2026-29185

Low

Advisory

Published 5 Mar 2026In the index since 8 Sept 2026

Backstage vulnerable to potential reading of SCM URLs using built in token

Carried by container images the latest versions of 2 of 17,781 indexed charts deploy, on 2 images.

Affected package	Affected versions	Fixed in	Images
@backstage/integrationnpm	0.5.9, 1.15.0	1.20.1	2

2 by stars

Chart

Latest

Affected images

Radar Score

backstageirembo-backstage-helm

1 of the 3 container images this version deploys carry CVE-2026-29185.

Container image	Digest	Package	Fixed in
roadiehq/community-backstage-image :latest	ef355bf5b639	@backstage/integration@0.5.9	1.20.1

7,232

1 of the 2 container images this version deploys carry CVE-2026-29185.

Container image	Digest	Package	Fixed in
ghcr.io/mcwarman/backstage-sample-app/backend :main	07aba09a594f	@backstage/integration@1.15.0	1.20.1

9,668

2 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
roadiehq/community-backstage-image :latest	ef355bf5b639	@backstage/integration@0.5.9	1.20.1	1
ghcr.io/mcwarman/backstage-sample-app/backend :main	07aba09a594f	@backstage/integration@1.15.0	1.20.1	1