CVE-2026-106500

Analyzed Analyzed - Analysis Complete

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-13

Assigner: GitHub, Inc.

Description

Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by improper task state validation in scaffolder backend. An authenticated user with permission to create and access Scaffolder tasks may, under specific timing and deployment conditions, affect files accessible to the Backstage backend. If backend application files are writable, the confidentiality, integrity, and availability of the backend may be compromised. This issue is fixed in versions 3.3.1, 3.4.1, 4.0.3 and 4.1.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-13

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-106500

EUVD

EUVD-2026-94058

Affected Vendors & Products

Vendor	Product	Version / Range
linuxfoundation	backstage/plugin-scaffolder-backend	to 3.3.1 (exc)
linuxfoundation	backstage/plugin-scaffolder-backend	From 3.4.0 (inc) to 3.4.1 (exc)
linuxfoundation	backstage/plugin-scaffolder-backend	From 4.0.0 (inc) to 4.0.3 (exc)
linuxfoundation	backstage/plugin-scaffolder-backend	From 4.0.4 (inc) to 4.1.0 (exc)
linuxfoundation	backstage	to 1.49.6 (exc)
linuxfoundation	backstage	From 1.50.0 (inc) to 1.50.5 (exc)
linuxfoundation	backstage	From 1.51.0 (inc) to 1.54.6 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-59	The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
CWE-362	The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Attack-Flow Graph

Executive Summary

This vulnerability affects the @backstage/plugin-scaffolder-backend package in Backstage versions before 3.3.1, 3.4.1, 4.0.3, and 4.1.0. It involves improper task state validation in the scaffolder backend, allowing an authenticated user with task creation permissions to potentially modify backend files under specific timing and deployment conditions.

Detection Guidance

To detect this vulnerability, check the version of the @backstage/plugin-scaffolder-backend package in your Backstage deployment. If it is below 3.3.1, 3.4.1, 4.0.3, or 4.1.0, the system is vulnerable. Use commands like 'npm list @backstage/plugin-scaffolder-backend' or inspect package.json and package-lock.json files.

Impact Analysis

If exploited, this vulnerability could compromise the confidentiality, integrity, and availability of the Backstage backend. An attacker could affect files accessible to the backend, potentially leading to unauthorized data access, modification, or system disruption.

Compliance Impact

The vulnerability could potentially impact compliance with GDPR and HIPAA if backend application files are writable. An attacker could compromise confidentiality, integrity, and availability of backend data, which may include sensitive personal or health information. This could lead to unauthorized access, data breaches, or data integrity issues, violating GDPR's data protection principles or HIPAA's security requirements.

Mitigation Strategies

Immediately upgrade the @backstage/plugin-scaffolder-backend package to version 3.3.1, 3.4.1, 4.0.3, or 4.1.0 or later. Review file permissions on the Backstage backend to ensure no writable application files are accessible by unauthorized users.

Hi! I’m here to help you understand CVE-2026-106500. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70