CVE-2026-106462
mediumBackstage is an open framework for building developer portals.
Vendor / product: Linuxfoundation — backstage\/plugin-scaffolder-backend
Backstage is an open framework for building developer portals. Prior to 1.54.6, scaffolder source-control actions may not consistently enforce intended credential boundaries. An authenticated user could cause an affected action to fall back to broader integration credentials and perform operations with more access than intended. This issue is fixed in 1.54.6 when operators also enable scaffolder.requireScmUserCredentials after upgrading.
CVSS
6.4
6.4 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N Severity source: NVD CVSS v3.1 (security-advisories@github.com)
Timeline (UTC)
Published: 2026-10-06 21:17
Modified: 2026-10-22 18:53
NVD status: Analyzed
Last synced 1 day ago
Verified against the source API 2026-10-27 06:58 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
linuxfoundation / backstage\/plugin-scaffolder-backend <0.11.10
linuxfoundation / backstage\/plugin-scaffolder-backend-module-azure <0.2.25
linuxfoundation / backstage\/plugin-scaffolder-backend-module-bitbucket-cloud <0.3.10
linuxfoundation / backstage\/plugin-scaffolder-backend-module-bitbucket-server <0.2.25
linuxfoundation / backstage\/plugin-scaffolder-backend-module-github <0.9.13
linuxfoundation / backstage\/plugin-scaffolder-backend-module-gitlab <0.11.10
linuxfoundation / backstage <1.54.6
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Patch / mitigation: https://github.com/backstage/backstage/commit/6fb2a41ea47da37eafe5ea744050ef90be6820c0
Patch / mitigation: https://github.com/backstage/backstage/releases/tag/v1.54.6
Patch / mitigation: https://github.com/backstage/backstage/security/advisories/GHSA-29gx-h2m3-xw44
References
- https://github.com/backstage/backstage/commit/6fb2a41ea47da37eafe5ea744050ef90be6820c0 security-advisories@github.com
- https://github.com/backstage/backstage/releases/tag/v1.54.6 security-advisories@github.com
- https://github.com/backstage/backstage/security/advisories/GHSA-29gx-h2m3-xw44 security-advisories@github.com
Data sources
NVD CVE API 2.0 — fetched 2026-10-27 06:58 UTC · record ↗