Homepage

@backstage/plugin-kubernetes-backend@0.0.0-nightly-20260711031351

A Backstage backend plugin that integrates towards Kubernetes

  • latest version

    0.21.11

  • latest non vulnerable version

    0.22.0-next.1

  • first published

    6 years ago

  • latest version published

    1 months ago

  • View plugin-kubernetes-backend package health on Snyk  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the @backstage/plugin-kubernetes-backend package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • M
    Missing Authorization

    @backstage/plugin-kubernetes-backend is an A Backstage backend plugin that integrates towards Kubernetes

    Affected versions of this package are vulnerable to Missing Authorization via the Kubernetes objects endpoint in KubernetesRouter, where the entity field supplied in the request body is used directly without being validated against the catalog. An authenticated attacker can supply an arbitrary entity reference in the request body to retrieve Kubernetes objects associated with an entity they are not authorized to access, bypassing catalog-level access controls.

    How to fix Missing Authorization?

    Upgrade @backstage/plugin-kubernetes-backend to version 0.21.8 or higher.

    <0.21.8
    • M
    Incorrect Authorization

    @backstage/plugin-kubernetes-backend is an A Backstage backend plugin that integrates towards Kubernetes

    Affected versions of this package are vulnerable to Incorrect Authorization via the sanitizeKubernetesResponse method in KubernetesFetcher.ts, where Kubernetes Secret values are not redacted when the resource is queried as a custom resource whose list kind resolves to SecretList. An authenticated attacker with access to the Backstage Kubernetes backend can read plaintext Secret data and stringData field values that should be masked, by querying the affected custom resource path.

    How to fix Incorrect Authorization?

    Upgrade @backstage/plugin-kubernetes-backend to version 0.21.9 or higher.

    <0.21.9
    • L
    Unintended Proxy or Intermediary ('Confused Deputy')

    @backstage/plugin-kubernetes-backend is an A Backstage backend plugin that integrates towards Kubernetes

    Affected versions of this package are vulnerable to Unintended Proxy or Intermediary ('Confused Deputy') via CatalogClusterLocator in plugins/kubernetes-backend/src/cluster-locator/CatalogClusterLocator.ts, where a cluster entity annotated with the serviceAccount auth provider is silently accepted rather than rejected. Instead of throwing an error, the locator previously only logged a warning and returned undefined, allowing a catalog-defined cluster with an unsupported authentication provider to pass through validation. An authenticated attacker who can create or modify catalog entities can supply a serviceAccount-annotated Kubernetes cluster resource to influence cluster authentication handling in unintended ways, potentially leaking cluster configuration details.

    How to fix Unintended Proxy or Intermediary ('Confused Deputy')?

    Upgrade @backstage/plugin-kubernetes-backend to version 0.21.10 or higher.

    <0.21.10
    Go back to all versions of this package