Medium severity · published Oct 6, 2026
CVE-2026-106462
Backstage: Scaffolder credential handling may allow unintended GitHub authentication fallback
6.4
CVSS
0.2%
EPSS
No
On KEV
Description
Backstage is an open framework for building developer portals. Prior to 1.54.6, scaffolder source-control actions may not consistently enforce intended credential boundaries. An authenticated user could cause an affected action to fall back to broader integration credentials and perform operations with more access than intended. This issue is fixed in 1.54.6 when operators also enable scaffolder.requireScmUserCredentials after upgrading.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 7% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BA
backstage · backstage
< 1.54.6 · source: vendor, NVD
PL
plugin-scaffolder-backend · @backstage
< 4.1.0 · source: vendor
PL
plugin-scaffolder-backend-module-azure · @backstage
< 0.2.25 · source: vendor
PL
plugin-scaffolder-backend-module-bitbucket-cloud · @backstage
< 0.3.10 · source: vendor
PL
plugin-scaffolder-backend-module-bitbucket-server · @backstage
< 0.2.25 · source: vendor
PL
plugin-scaffolder-backend-module-github · @backstage
< 0.9.13 · source: vendor
PL
plugin-scaffolder-backend-module-gitlab · @backstage
< 0.11.10 · source: vendor
BA
Backstage/plugin-scaffolder-backend · Linuxfoundation
before 0.11.10 · source: NVD
BA
Backstage/plugin-scaffolder-backend-module-azure · Linuxfoundation
before 0.2.25 · source: NVD
BA
Backstage/plugin-scaffolder-backend-module-bitbucket-cloud · Linuxfoundation
before 0.3.10 · source: NVD
BA
Backstage/plugin-scaffolder-backend-module-bitbucket-server · Linuxfoundation
before 0.2.25 · source: NVD
BA
Backstage/plugin-scaffolder-backend-module-github · Linuxfoundation
before 0.9.13 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-106462
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-106462
x_refsource_CONFIRM
https://github.com/backstage/backstage/security/advisories/GHSA-29gx-h2m3-xw44
x_refsource_MISC
https://github.com/backstage/backstage/commit/6fb2a41ea47da37eafe5ea744050ef90be6820c0
x_refsource_MISC
https://github.com/backstage/backstage/releases/tag/v1.54.6
More from plugin-scaffolder-backend
9.6
CVE-2026-106501
Backstage: Sensitive information exposure in Scaffolder
8.5
CVE-2026-106500
Backstage: Improper task state validation in Scaffolder backend
8.1
CVE-2026-106503
Backstage: Scaffolder action input authorization bypass
6.5
CVE-2026-106504
Backstage: Sensitive information exposure in scaffolder task logs
5.3
CVE-2026-106506
Backstage: Improper input validation in scaffolder task list ordering