CVE-2026-106462 · GHSA-29gx-h2m3-xw44

Backstage's scaffolder credential handling may allow unintended GitHub authentication fallback

Risk score: 50/100
CVSS: 6.4 v3.1
Exploit chance (30 days): 0.2%
Published: 6 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: Backstage is an open framework for building developer portals. Prior to 1.54.6, scaffolder source-control actions may not consistently enforce intended credential boundaries. An authenticated user could cause an affected action to fall back to broader integration credentials and perform operations with more access tha…
Affected: @backstage/plugin-scaffolder-backend (npm) < 4.1.0; @backstage/plugin-scaffolder-backend-module-github (npm) < 0.9.13; @backstage/plugin-scaffolder-backend-module-gitlab (npm) < 0.11.10; @backstage/plugin-scaffolder-backend-module-azure (npm) < 0.2.25
Fix: Upgrade @backstage/plugin-scaffolder-backend to 4.1.0; @backstage/plugin-scaffolder-backend-module-github to 0.9.13; @backstage/plugin-scaffolder-backend-module-gitlab to 0.11.10; @backstage/plugin-scaffolder-backend-module-azure to 0.2.25; @backstage/plugin-scaffolder-backend-module-bitbucket-clou…
Exploitation: No known exploitation

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

@backstage/plugin-scaffolder-backend: Amber, patch this week. Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by sensitive information exposure in scaffolder. An authenticated Backstage user who can read another user's Scaffolder task may receive internal execution…

The flaws

CVE-2026-106462: Backstage's scaffolder credential handling may allow unintended GitHub authentication fallback (CVSS 6.4 · EPSS 0%)
CVE-2026-106501: Backstage: Sensitive information exposure in Scaffolder (CVSS 9.6 · EPSS 0%)
CVE-2026-106500: Backstage: Improper task state validation in Scaffolder backend (CVSS 8.5 · EPSS 0%)
CVE-2026-106503: Backstage: Scaffolder action input authorization bypass (CVSS 8.1 · EPSS 0%)

The fix

Upgrade @backstage/plugin-scaffolder-backend: 1.54.6 · 3.3.1 · 3.4.1 · 4.0.3 · 4.1.0 or later on your release line

Who is exposed: @backstage/plugin-scaffolder-backend (npm) < 3.3.1; @backstage/plugin-scaffolder-backend (npm) >= 3.4.0, < 3.4.1; @backstage/plugin-scaffolder-backend (npm) >= 4.0.0, < 4.0.3; @backstage/plugin-scaffolder-backend (npm) >= 4.0.4, < 4.1.0

Where it stands

No known exploitation

Connects to

Same weakness: CWE-441 (CWE-441). 32 other warnings in 30 days
Same product: Earlier @backstage/plugin-scaffolder-backend warnings. 5 in the last 90 days

Why it is Yellow

CVSS 6.4 medium
On your watchlist: azure, npm

Affected packages

Package	Ecosystem	Vulnerable	Fixed in
@backstage/plugin-scaffolder-backend	npm	< 4.1.0	4.1.0
@backstage/plugin-scaffolder-backend-module-github	npm	< 0.9.13	0.9.13
@backstage/plugin-scaffolder-backend-module-gitlab	npm	< 0.11.10	0.11.10
@backstage/plugin-scaffolder-backend-module-azure	npm	< 0.2.25	0.2.25
@backstage/plugin-scaffolder-backend-module-bitbucket-cloud	npm	< 0.3.10	0.3.10
@backstage/plugin-scaffolder-backend-module-bitbucket-server	npm	< 0.2.25	0.2.25

References

Original description

Backstage is an open framework for building developer portals. Prior to 1.54.6, scaffolder source-control actions may not consistently enforce intended credential boundaries. An authenticated user could cause an affected action to fall back to broader integration credentials and perform operations with more access than intended. This issue is fixed in 1.54.6 when operators also enable scaffolder.requireScmUserCredentials after upgrading.

Last activity 6 Oct 2026. Patch Forecast updates every hour.