CVE-2026-106462
Full vulnerability record from the local CVENow database.
Description
Backstage is an open framework for building developer portals. Prior to 1.54.6, scaffolder source-control actions may not consistently enforce intended credential boundaries. An authenticated user could cause an affected action to fall back to broader integration credentials and perform operations with more access than intended. This issue is fixed in 1.54.6 when operators also enable scaffolder.requireScmUserCredentials after upgrading.
Severity
MEDIUM
CVSS score
6.4
(v3.1)
Vulnerability status
Analyzed
Source identifier
Published
2026-10-06 21:17:17.020000
Last modified
2026-10-22 18:53:09.440000
View original CVE JSON
{
"id": "CVE-2026-106462",
"sourceIdentifier": "[email protected]",
"published": "2026-10-06T21:17:17.020",
"lastModified": "2026-10-22T18:53:09.440",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Backstage is an open framework for building developer portals. Prior to 1.54.6, scaffolder source-control actions may not consistently enforce intended credential boundaries. An authenticated user could cause an affected action to fall back to broader integration credentials and perform operations with more access than intended. This issue is fixed in 1.54.6 when operators also enable scaffolder.requireScmUserCredentials after upgrading."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "backstage",
"product": "backstage",
"versions": [
{
"version": "< 1.54.6",
"status": "affected"
}
]
},
{
"vendor": "@backstage",
"product": "plugin-scaffolder-backend",
"versions": [
{
"version": "< 4.1.0",
"status": "affected"
}
]
},
{
"vendor": "@backstage",
"product": "plugin-scaffolder-backend-module-azure",
"versions": [
{
"version": "< 0.2.25",
"status": "affected"
}
]
},
{
"vendor": "@backstage",
"product": "plugin-scaffolder-backend-module-bitbucket-cloud",
"versions": [
{
"version": "< 0.3.10",
"status": "affected"
}
]
},
{
"vendor": "@backstage",
"product": "plugin-scaffolder-backend-module-bitbucket-server",
"versions": [
{
"version": "< 0.2.25",
"status": "affected"
}
]
},
{
"vendor": "@backstage",
"product": "plugin-scaffolder-backend-module-github",
"versions": [
{
"version": "< 0.9.13",
"status": "affected"
}
]
},
{
"vendor": "@backstage",
"product": "plugin-scaffolder-backend-module-gitlab",
"versions": [
{
"version": "< 0.11.10",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 3.1,
"impactScore": 2.7
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-10-07T15:13:05.681052Z",
"id": "CVE-2026-106462",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-441"
},
{
"lang": "en",
"value": "CWE-863"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:linuxfoundation:backstage\\/plugin-scaffolder-backend:*:*:*:*:*:node.js:*:*",
"versionEndExcluding": "0.11.10",
"matchCriteriaId": "554B8EEF-9383-4C89-94CC-6D4E310C401F"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:linuxfoundation:backstage\\/plugin-scaffolder-backend-module-azure:*:*:*:*:*:node.js:*:*",
"versionEndExcluding": "0.2.25",
"matchCriteriaId": "0C67C4AA-6610-4536-9CEF-562872DEB622"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:linuxfoundation:backstage\\/plugin-scaffolder-backend-module-bitbucket-cloud:*:*:*:*:*:node.js:*:*",
"versionEndExcluding": "0.3.10",
"matchCriteriaId": "51A44535-7A5D-46B0-AC79-5E9DAE726BAE"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:linuxfoundation:backstage\\/plugin-scaffolder-backend-module-bitbucket-server:*:*:*:*:*:node.js:*:*",
"versionEndExcluding": "0.2.25",
"matchCriteriaId": "19CE6595-34DE-4124-B304-FDEFCB3FD00B"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:linuxfoundation:backstage\\/plugin-scaffolder-backend-module-github:*:*:*:*:*:node.js:*:*",
"versionEndExcluding": "0.9.13",
"matchCriteriaId": "164D0465-E901-496E-81D9-935CA9E23C73"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:linuxfoundation:backstage\\/plugin-scaffolder-backend-module-gitlab:*:*:*:*:*:node.js:*:*",
"versionEndExcluding": "0.11.10",
"matchCriteriaId": "B41C96A0-5669-463A-BFC7-B459D29A69D3"
}
]
}
]
},
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.54.6",
"matchCriteriaId": "630B6B8B-D515-4FEF-83C7-9CF51C7EB2F5"
}
]
}
]
}
],
"references": [
{
"url": "https://github.com/backstage/backstage/commit/6fb2a41ea47da37eafe5ea744050ef90be6820c0",
"source": "[email protected]",
"tags": [
"Patch"
]
},
{
"url": "https://github.com/backstage/backstage/releases/tag/v1.54.6",
"source": "[email protected]",
"tags": [
"Patch",
"Release Notes"
]
},
{
"url": "https://github.com/backstage/backstage/security/advisories/GHSA-29gx-h2m3-xw44",
"source": "[email protected]",
"tags": [
"Mitigation",
"Vendor Advisory"
]
}
]
}