Backstage scaffolder may fall back to broader integration credentials
Priority LOW 28CWE-441Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Partial Red Hat: 2 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-863.
Summary
Backstage before 1.54.6 and several @backstage scaffolder packages are affected. Scaffolder source-control actions do not consistently enforce intended credential boundaries, which is a confused deputy flaw (CWE-441). An authenticated user can cause an affected action to fall back to broader integration credentials and perform operations with more access than intended.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
Backstage is an open framework for building developer portals. Prior to 1.54.6, scaffolder source-control actions may not consistently enforce intended credential boundaries. An authenticated user could cause an affected action to fall back to broader integration credentials and perform operations with more access than intended. This issue is fixed in 1.54.6 when operators also enable scaffolder.requireScmUserCredentials after upgrading.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00172 6th percentileScored 2026-11-07
Fix Partial backstage (backstage): 1.54.6plugin-scaffolder-backend (@backstage): 4.1.0+11 more productsRed Hat: 2 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| backstage | backstage | before 1.54.6 | 1.54.6 | Patch available | CNA |
| backstage | plugin-scaffolder-backend | before 4.1.0 | 4.1.0 | Patch available | CNA |
| backstage | plugin-scaffolder-backend-module-azure | before 0.2.25 | 0.2.25 | Patch available | CNA |
| backstage | plugin-scaffolder-backend-module-bitbucket-cloud | before 0.3.10 | 0.3.10 | Patch available | CNA |
| backstage | plugin-scaffolder-backend-module-bitbucket-server | before 0.2.25 | 0.2.25 | Patch available | CNA |
| backstage | plugin-scaffolder-backend-module-github | before 0.9.13 | 0.9.13 | Patch available | CNA |
| backstage | plugin-scaffolder-backend-module-gitlab | before 0.11.10 | 0.11.10 | Patch available | CNA |
| — | @backstage/plugin-scaffolder-backend (npm) | before 4.1.0 | 4.1.0 | Patch available | GHSA-29gx-h2m3-xw44 |
| — | @backstage/plugin-scaffolder-backend-module-github (npm) | before 0.9.13 | 0.9.13 | Patch available | GHSA-29gx-h2m3-xw44 |
| — | @backstage/plugin-scaffolder-backend-module-gitlab (npm) | before 0.11.10 | 0.11.10 | Patch available | GHSA-29gx-h2m3-xw44 |
| — | @backstage/plugin-scaffolder-backend-module-azure (npm) | before 0.2.25 | 0.2.25 | Patch available | GHSA-29gx-h2m3-xw44 |
| — | @backstage/plugin-scaffolder-backend-module-bitbucket-cloud (npm) | before 0.3.10 | 0.3.10 | Patch available | GHSA-29gx-h2m3-xw44 |
| — | @backstage/plugin-scaffolder-backend-module-bitbucket-server (npm) | before 0.2.25 | 0.2.25 | Patch available | GHSA-29gx-h2m3-xw44 |
- backstage Vendorbackstage Affected before 1.54.6 Fixed in 1.54.6 Patch available CNA
- plugin-scaffolder-backend Vendorbackstage Affected before 4.1.0 Fixed in 4.1.0 Patch available CNA
- plugin-scaffolder-backend-module-azure Vendorbackstage Affected before 0.2.25 Fixed in 0.2.25 Patch available CNA
- plugin-scaffolder-backend-module-bitbucket-cloud Vendorbackstage Affected before 0.3.10 Fixed in 0.3.10 Patch available CNA
- plugin-scaffolder-backend-module-bitbucket-server Vendorbackstage Affected before 0.2.25 Fixed in 0.2.25 Patch available CNA
- plugin-scaffolder-backend-module-github Vendorbackstage Affected before 0.9.13 Fixed in 0.9.13 Patch available CNA
- plugin-scaffolder-backend-module-gitlab Vendorbackstage Affected before 0.11.10 Fixed in 0.11.10 Patch available CNA
- @backstage/plugin-scaffolder-backend (npm) Vendor— Affected before 4.1.0 Fixed in 4.1.0 Patch available GHSA-29gx-h2m3-xw44
- @backstage/plugin-scaffolder-backend-module-github (npm) Vendor— Affected before 0.9.13 Fixed in 0.9.13 Patch available GHSA-29gx-h2m3-xw44
- @backstage/plugin-scaffolder-backend-module-gitlab (npm) Vendor— Affected before 0.11.10 Fixed in 0.11.10 Patch available GHSA-29gx-h2m3-xw44
- @backstage/plugin-scaffolder-backend-module-azure (npm) Vendor— Affected before 0.2.25 Fixed in 0.2.25 Patch available GHSA-29gx-h2m3-xw44
- @backstage/plugin-scaffolder-backend-module-bitbucket-cloud (npm) Vendor— Affected before 0.3.10 Fixed in 0.3.10 Patch available GHSA-29gx-h2m3-xw44
- @backstage/plugin-scaffolder-backend-module-bitbucket-server (npm) Vendor— Affected before 0.2.25 Fixed in 0.2.25 Patch available GHSA-29gx-h2m3-xw44
CPE configurations NVD · 7
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:linuxfoundation:backstage\/plugin-scaffolder-backend:*:*:*:*:*:node.js:*:* | before 0.11.10 | Vulnerable | backstage |
| cpe:2.3:a:linuxfoundation:backstage\/plugin-scaffolder-backend-module-azure:*:*:*:*:*:node.js:*:* | before 0.2.25 | Vulnerable | backstage |
| cpe:2.3:a:linuxfoundation:backstage\/plugin-scaffolder-backend-module-bitbucket-cloud:*:*:*:*:*:node.js:*:* | before 0.3.10 | Vulnerable | backstage |
| cpe:2.3:a:linuxfoundation:backstage\/plugin-scaffolder-backend-module-bitbucket-server:*:*:*:*:*:node.js:*:* | before 0.2.25 | Vulnerable | backstage |
| cpe:2.3:a:linuxfoundation:backstage\/plugin-scaffolder-backend-module-github:*:*:*:*:*:node.js:*:* | before 0.9.13 | Vulnerable | backstage |
| cpe:2.3:a:linuxfoundation:backstage\/plugin-scaffolder-backend-module-gitlab:*:*:*:*:*:node.js:*:* | before 0.11.10 | Vulnerable | backstage |
| cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:* | before 1.54.6 | Vulnerable | backstage |
- cpe:2.3:a:linuxfoundation:backstage\/plugin-scaffolder-backend:*:*:*:*:*:node.js:*:* Versions before 0.11.10 Vulnerable ·backstage
- cpe:2.3:a:linuxfoundation:backstage\/plugin-scaffolder-backend-module-azure:*:*:*:*:*:node.js:*:* Versions before 0.2.25 Vulnerable ·backstage
- cpe:2.3:a:linuxfoundation:backstage\/plugin-scaffolder-backend-module-bitbucket-cloud:*:*:*:*:*:node.js:*:* Versions before 0.3.10 Vulnerable ·backstage
- cpe:2.3:a:linuxfoundation:backstage\/plugin-scaffolder-backend-module-bitbucket-server:*:*:*:*:*:node.js:*:* Versions before 0.2.25 Vulnerable ·backstage
- cpe:2.3:a:linuxfoundation:backstage\/plugin-scaffolder-backend-module-github:*:*:*:*:*:node.js:*:* Versions before 0.9.13 Vulnerable ·backstage
- cpe:2.3:a:linuxfoundation:backstage\/plugin-scaffolder-backend-module-gitlab:*:*:*:*:*:node.js:*:* Versions before 0.11.10 Vulnerable ·backstage
- cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:* Versions before 1.54.6 Vulnerable ·backstage
Remediation
Upgrade Backstage to 1.54.6 and then enable scaffolder.requireScmUserCredentials. Fixed npm versions are @backstage/plugin-scaffolder-backend 4.1.0, @backstage/plugin-scaffolder-backend-module-github 0.9.13, @backstage/plugin-scaffolder-backend-module-gitlab 0.11.10, @backstage/plugin-scaffolder-backend-module-azure 0.2.25, @backstage/plugin-scaffolder-backend-module-bitbucket-cloud 0.3.10 and @backstage/plugin-scaffolder-backend-module-bitbucket-server 0.2.25. Red Hat lists no available plan for Red Hat Developer Hub 1 and Self-service automation portal 2.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
- Fix · CNA backstage (backstage) Fixed in 1.54.6
- Fix · CNA plugin-scaffolder-backend (@backstage) Fixed in 4.1.0
- Fix · CNA plugin-scaffolder-backend-module-azure (@backstage) Fixed in 0.2.25
- Fix · CNA plugin-scaffolder-backend-module-bitbucket-cloud (@backstage) Fixed in 0.3.10
- Fix · CNA plugin-scaffolder-backend-module-bitbucket-server (@backstage) Fixed in 0.2.25
- Fix · CNA plugin-scaffolder-backend-module-github (@backstage) Fixed in 0.9.13
- Fix · CNA plugin-scaffolder-backend-module-gitlab (@backstage) Fixed in 0.11.10
- Fix · GHSA-29gx-h2m3-xw44 @backstage/plugin-scaffolder-backend (npm) Fixed in 4.1.0 Advisory →
- Fix · GHSA-29gx-h2m3-xw44 @backstage/plugin-scaffolder-backend-module-github (npm) Fixed in 0.9.13 Advisory →
- Fix · GHSA-29gx-h2m3-xw44 @backstage/plugin-scaffolder-backend-module-gitlab (npm) Fixed in 0.11.10 Advisory →
- Fix · GHSA-29gx-h2m3-xw44 @backstage/plugin-scaffolder-backend-module-azure (npm) Fixed in 0.2.25 Advisory →
- Fix · GHSA-29gx-h2m3-xw44 @backstage/plugin-scaffolder-backend-module-bitbucket-cloud (npm) Fixed in 0.3.10 Advisory →
- Fix · GHSA-29gx-h2m3-xw44 @backstage/plugin-scaffolder-backend-module-bitbucket-server (npm) Fixed in 0.2.25 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Developer Hub 1 | Affected | No fix yet: Fix deferred |
| Self-service automation portal 2 | Affected | No fix yet: Fix deferred |
Timeline
- 2026-10-07 Threatist record created from CVE-2026-106462
- 2026-10-07 CISA SSVC decision points changed
- 2026-10-07 Priority changed: MEDIUM → LOW
- 2026-10-07 Affected versions changed · Red Hat
- 2026-10-07 CVSS score added · Red Hat
- 2026-10-07 Alias added: GHSA-29gx-h2m3-xw44
- 2026-10-07 Fix available: npm/@backstage/[email protected], npm/@backstage/[email protected], npm/@backstage/[email protected] +3 · GHSA-29gx-h2m3-xw44
- 2026-10-07 CVSS score added · GHSA-29gx-h2m3-xw44
- 2026-10-07 Weakness changed · GHSA-29gx-h2m3-xw44
- 2026-10-07 6 new references · GHSA-29gx-h2m3-xw44
- 2026-10-27 Affected versions changed · Red Hat
References
Patch 2
Advisory 2
More Backstage vulnerabilities
- TI-2023-17988 Insecure sandbox in Backstage Scaffolder plugin CVSS 3.1CRITICAL 9.9
- TI-2026-69075 Sensitive information exposure in Backstage Scaffolder CVSS 3.1CRITICAL 9.6
- TI-2026-69061 Path traversal in Backstage Bitbucket pull-request scaffolder actions CVSS 3.1CRITICAL 9.9
- TI-2026-60083 Backstage: Improper input validation in TechDocs MkDocs configuration CVSS 3.1HIGH 8.8
- TI-2026-69165 Backstage TechDocs config flaw allows code execution CVSS 3.1HIGH 8.8
- TI-2026-69083 Code injection via MkDocs theme configuration in Backstage TechDocs CVSS 3.1HIGH 8.8
Sources
- CVE-2026-106462 · CVE Program
- CVE-2026-106462 · NVD
- FIRST EPSS
- GHSA-29gx-h2m3-xw44 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-106462 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences