CVE-2026-106500 · GHSA-xvgh-hmx8-9xxf
Backstage: Improper task state validation in Scaffolder backend
- Risk score
- 61/100
- CVSS
- 8.5 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 6 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by improper task state validation in scaffolder backend. An authenticated user with permission to create and access Scaffolder tasks may, under specific ti…
- Affected
- @backstage/plugin-scaffolder-backend (npm) < 4.1.0
- Fix
- Upgrade @backstage/plugin-scaffolder-backend to 4.1.0 or later.
- Exploitation
- No known exploitation
Story map
At a glance
@backstage/plugin-scaffolder-backend: Amber, patch this week. Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by sensitive information exposure in scaffolder. An authenticated Backstage user who can read another user's Scaffolder task may receive internal execution…
The flaws
- CVE-2026-106500: Backstage: Improper task state validation in Scaffolder backend (CVSS 8.5 · EPSS 0%)
- CVE-2026-106501: Backstage: Sensitive information exposure in Scaffolder (CVSS 9.6 · EPSS 0%)
- CVE-2026-106503: Backstage: Scaffolder action input authorization bypass (CVSS 8.1 · EPSS 0%)
- CVE-2026-106462: Backstage's scaffolder credential handling may allow unintended GitHub authentication fallback (CVSS 6.4 · EPSS 0%)
The fix
Upgrade @backstage/plugin-scaffolder-backend: 3.3.1 · 3.4.1 · 4.0.3 · 4.1.0 · 1.54.6 or later on your release line
Who is exposed: @backstage/plugin-scaffolder-backend (npm) < 3.3.1; @backstage/plugin-scaffolder-backend (npm) >= 3.4.0, < 3.4.1; @backstage/plugin-scaffolder-backend (npm) >= 4.0.0, < 4.0.3; @backstage/plugin-scaffolder-backend (npm) >= 4.0.4, < 4.1.0
Where it stands
- No known exploitation
Connects to
- Same weakness: CWE-59 (CWE-59). 78 other warnings in 30 days
- Same product: Earlier @backstage/plugin-scaffolder-backend warnings. 5 in the last 90 days
Why it is Amber
- CVSS 8.5 high
- On your watchlist: npm
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| @backstage/plugin-scaffolder-backend | npm | < 4.1.0 | 4.1.0 |
References
- https://github.com/advisories/GHSA-xvgh-hmx8-9xxf
- https://github.com/backstage/backstage/security/advisories/GHSA-xvgh-hmx8-9xxf
- https://nvd.nist.gov/vuln/detail/CVE-2026-106500
- https://github.com/backstage/backstage/commit/0d24f1b8701f3dde6cd597f81997c1ea873a43ae
- https://github.com/backstage/backstage/commit/56be299dd3ef6706e13e76ea2f8a9b0dd0b6413d
- https://github.com/backstage/backstage/commit/9e86c95a1a3ddfd54db03731cd8678aa63495175
- https://github.com/backstage/backstage/releases/tag/v1.49.6
- https://github.com/backstage/backstage/releases/tag/v1.50.5
- https://github.com/backstage/backstage/releases/tag/v1.54.6
- https://github.com/advisories/GHSA-xvgh-hmx8-9xxf
Original description
Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by improper task state validation in scaffolder backend. An authenticated user with permission to create and access Scaffolder tasks may, under specific timing and deployment conditions, affect files accessible to the Backstage backend. If backend application files are writable, the confidentiality, integrity, and availability of the backend may be compromised. This issue is fixed in versions 3.3.1, 3.4.1, 4.0.3 and 4.1.0.
Last activity 6 Oct 2026. Patch Forecast updates every hour.