Every CVE Search/ Get API key

CVE-2026-106462

Backstage: Scaffolder credential handling may allow unintended GitHub authentication fallback

6.4 MediumFix available

Backstage is an open framework for building developer portals. Prior to 1.54.6, scaffolder source-control actions may not consistently enforce intended credential boundaries. An authenticated user could cause an affected action to fall back to broader integration credentials and perform operations with more access than intended. This issue is fixed in 1.54.6 when operators also enable scaffolder.requireScmUserCredentials after upgrading.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

0.17%Unchanged since Oct 7, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.4

Backstage: Scaffolder credential handling may allow unintended GitHub authentication fallback

Backstage is an open framework for building developer portals. Prior to 1.54.6, scaffolder source-control actions may not consistently enforce intended credential boundaries. An authenticated user could cause an affected action to fall back to broader integration credentials and perform operations with more access than intended. This issue is fixed in 1.54.6 when operators also enable scaffolder.requireScmUserCredentials after upgrading.

Record
CVE-2026-106462
CVSS 3.1
6.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Weakness
CWE-441, CWE-863
Updated
2026-11-02
EUVDEUVD-2026-93999 6.4

Backstage is an open framework for building developer portals. Prior to 1.54.6, scaffolder source-control actions may not consistently enforce intended credential boundaries. An authenticated user could cause an affected action to fall back to broader integration credentials and perform operations with more access than intended. This issue is fixed in 1.54.6 when operators also enable scaffolder.requireScmUserCredentials after upgrading.

Record
EUVD-2026-93999
CVSS 3.1
6.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-29gx-h2m3-xw44 6.4

Backstage's scaffolder credential handling may allow unintended GitHub authentication fallback

Impact

Scaffolder actions that interact with source control systems may not consistently enforce the intended credential boundaries under certain configurations. An authenticated user could perform operations with broader access than intended.

Patches

  • @backstage/plugin-scaffolder-backend version 4.1.0
  • @backstage/plugin-scaffolder-backend-module-azure version 0.2.25
  • @backstage/plugin-scaffolder-backend-module-bitbucket-cloud version 0.3.10
  • @backstage/plugin-scaffolder-backend-module-bitbucket-server version 0.2.25
  • @backstage/plugin-scaffolder-backend-module-github version 0.9.13
  • @backstage/plugin-scaffolder-backend-module-gitlab version 0.11.10

The fix introduces a new configuration option that enforces user-provided credentials for supported SCM actions. The new behavior is opt-in for compatibility. After upgrading, set:

scaffolder:
  requireScmUserCredentials: true

Before enabling this setting, review and update your templates as described in the software templates documentation referred to below.

Workarounds

If you cannot upgrade and enable the setting immediately:

  • Restrict who can create Scaffolder tasks and which templates they can execute.
  • Limit SCM integration credentials to the minimum repository read and mutation permissions required.
  • Remove integration credentials for SCM hosts where all required operations can use explicitly supplied user tokens.
Record
GHSA-29gx-h2m3-xw44
CVSS 3.1
6.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Weakness
CWE-441, CWE-863
Updated
2026-11-02
NVD 6.4

Backstage is an open framework for building developer portals. Prior to 1.54.6, scaffolder source-control actions may not consistently enforce intended credential boundaries. An authenticated user could cause an affected action to fall back to broader integration credentials and perform operations with more access than intended. This issue is fixed in 1.54.6 when operators also enable scaffolder.requireScmUserCredentials after upgrading.

Record
CVE-2026-106462
CVSS 3.1
6.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Weakness
CWE-441, CWE-863
Updated
2026-11-02
OSV 6.4

Backstage: Scaffolder credential handling may allow unintended GitHub authentication fallback

Backstage is an open framework for building developer portals. Prior to 1.54.6, scaffolder source-control actions may not consistently enforce intended credential boundaries. An authenticated user could cause an affected action to fall back to broader integration credentials and perform operations with more access than intended. This issue is fixed in 1.54.6 when operators also enable scaffolder.requireScmUserCredentials after upgrading.

Record
CVE-2026-106462
CVSS 3.1
6.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Weakness
CWE-441, CWE-863
Updated
2026-11-02
OSVGHSA-29gx-h2m3-xw44 6.4

Backstage's scaffolder credential handling may allow unintended GitHub authentication fallback

Impact

Scaffolder actions that interact with source control systems may not consistently enforce the intended credential boundaries under certain configurations. An authenticated user could perform operations with broader access than intended.

Patches

  • @backstage/plugin-scaffolder-backend version 4.1.0
  • @backstage/plugin-scaffolder-backend-module-azure version 0.2.25
  • @backstage/plugin-scaffolder-backend-module-bitbucket-cloud version 0.3.10
  • @backstage/plugin-scaffolder-backend-module-bitbucket-server version 0.2.25
  • @backstage/plugin-scaffolder-backend-module-github version 0.9.13
  • @backstage/plugin-scaffolder-backend-module-gitlab version 0.11.10

The fix introduces a new configuration option that enforces user-provided credentials for supported SCM actions. The new behavior is opt-in for compatibility. After upgrading, set:

scaffolder:
  requireScmUserCredentials: true

Before enabling this setting, review and update your templates as described in the software templates documentation referred to below.

Workarounds

If you cannot upgrade and enable the setting immediately:

  • Restrict who can create Scaffolder tasks and which templates they can execute.
  • Limit SCM integration credentials to the minimum repository read and mutation permissions required.
  • Remove integration credentials for SCM hosts where all required operations can use explicitly supplied user tokens.
Record
GHSA-29gx-h2m3-xw44
CVSS 3.1
6.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Weakness
CWE-441, CWE-863
Updated
2026-11-02

Affected products

Show 2 moreShow less

Affected packages

Affected packages
PackageAffectedFixed
@backstage/plugin-scaffolder-backend
npm
 before 4.1.0
4.1.0
@backstage/plugin-scaffolder-backend-module-github
npm
 before 0.9.13
0.9.13
@backstage/plugin-scaffolder-backend-module-gitlab
npm
 before 0.11.10
0.11.10
@backstage/plugin-scaffolder-backend-module-azure
npm
 before 0.2.25
0.2.25
@backstage/plugin-scaffolder-backend-module-bitbucket-cloud
npm
 before 0.3.10
0.3.10
@backstage/plugin-scaffolder-backend-module-bitbucket-server
npm
 before 0.2.25
0.2.25

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-106462 is a medium vulnerability (CVSS 6.4) in Backstage, published October 6, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.17%, the 6th percentile. Fixed in @backstage/plugin-scaffolder-backend 4.1.0.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open