CVE-2026-106500
Received
Received - Intake
Improper Task State Validation in Backstage Scaffolder Backend
Vulnerability report for CVE-2026-106500, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-06
Last updated on: 2026-10-06
Assigner: GitHub, Inc.
Description
Description
Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by improper task state validation in scaffolder backend. An authenticated user with permission to create and access Scaffolder tasks may, under specific timing and deployment conditions, affect files accessible to the Backstage backend. If backend application files are writable, the confidentiality, integrity, and availability of the backend may be compromised. This issue is fixed in versions 3.3.1, 3.4.1, 4.0.3 and 4.1.0.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| backstage | backstage | < 1.49.6 |
| backstage | backstage | >= 1.50.0-next.0, < 1.50.5 |
| backstage | backstage | >= 1.51.0-next.0, < 1.54.6 |
| @backstage | plugin-scaffolder-backend | < 3.3.1 |
| @backstage | plugin-scaffolder-backend | >= 3.4.0, < 3.4.1 |
| @backstage | plugin-scaffolder-backend | >= 4.0.0, < 4.0.3 |
| @backstage | plugin-scaffolder-backend | >= 4.0.4, < 4.1.0 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-59 | The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource. |
| CWE-362 | The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently. |
