CVE-2026-106462
Undergoing Analysis Undergoing Analysis - In Progress

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-07

Assigner: GitHub, Inc.

Description
Backstage is an open framework for building developer portals. Prior to 1.54.6, scaffolder source-control actions may not consistently enforce intended credential boundaries. An authenticated user could cause an affected action to fall back to broader integration credentials and perform operations with more access than intended. This issue is fixed in 1.54.6 when operators also enable scaffolder.requireScmUserCredentials after upgrading.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-06
Last Modified
2026-10-07
Generated
2026-10-19
AI Q&A
2026-10-07
EPSS Evaluated
2026-10-18
NVD
CVE-2026-106462
EUVD
EUVD-2026-93999

Affected Vendors & Products

Showing 7 associated CPEs
Vendor Product Version / Range
backstage backstage < 1.54.6
@backstage plugin-scaffolder-backend < 4.1.0
@backstage plugin-scaffolder-backend-module-azure < 0.2.25
@backstage plugin-scaffolder-backend-module-bitbucket-cloud < 0.3.10
@backstage plugin-scaffolder-backend-module-bitbucket-server < 0.2.25
@backstage plugin-scaffolder-backend-module-github < 0.9.13
@backstage plugin-scaffolder-backend-module-gitlab < 0.11.10

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
CWE-441 The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere. This causes the product to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Backstage is a framework for building developer portals. This vulnerability involves scaffolder source-control actions not consistently enforcing credential boundaries. An authenticated user could exploit this to cause an action to use broader integration credentials, gaining more access than intended. The issue is fixed in version 1.54.6 if operators enable scaffolder.requireScmUserCredentials after upgrading.

Detection Guidance

This vulnerability requires checking Backstage configurations and installed plugin versions. Verify if the affected plugins are installed and if the version is below 1.54.6. Check the Backstage instance for the scaffolder plugin configurations, particularly the use of broader integration credentials without proper boundaries.

Impact Analysis

An authenticated attacker could perform unauthorized operations with elevated privileges by exploiting credential boundaries. This may lead to data breaches, unauthorized access to repositories, or other malicious activities depending on the affected system's permissions.

Compliance Impact

This vulnerability could lead to unauthorized access or data exposure, violating compliance requirements such as GDPR's data protection principles or HIPAA's security rules. Organizations may face legal penalties, reputational damage, and increased scrutiny from regulators.

Mitigation Strategies

Upgrade Backstage to version 1.54.6 or later. After upgrading, enable the scaffolder.requireScmUserCredentials setting to enforce credential boundaries.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-106462. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart