CVE Feed

    Dashboard / CVE / CVE-2026-106462

    CVE-2026-106462

    Backstage is an open framework for building developer portals. Prior to 1.54.6, scaffolder source-control actions may not consistently enforce intended credential boundaries. An authenticated user could cause an affected action to fall back to broader integration credentials and perform operations with more access than intended. This issue is fixed in 1.54.6 when operators also enable scaffolder.requireScmUserCredentials after upgrading.

    Published:Oct 6, 2026
    Last Modified:Oct 22, 2026
    EPS:Oct 6, 2026
    EPSS Score:0.00171
    CVSS Score:6.4

    Affected Products

    Vendor
    Backstage
    Product
    Backstage
    Vendor
    Backstage
    Product
    Plugin-scaffolder-backend
    Vendor
    Backstage
    Product
    Plugin-scaffolder-backend-module-azure
    Vendor
    Backstage
    Product
    Plugin-scaffolder-backend-module-bitbucket-cloud
    Vendor
    Backstage
    Product
    Plugin-scaffolder-backend-module-bitbucket-server
    Vendor
    Backstage
    Product
    Plugin-scaffolder-backend-module-github
    Vendor
    Backstage
    Product
    Plugin-scaffolder-backend-module-gitlab
    Vendor
    Linuxfoundation
    Product
    Backstage
    Vendor
    Linuxfoundation
    Product
    Backstage\/plugin-scaffolder-backend
    Vendor
    Linuxfoundation
    Product
    Backstage\/plugin-scaffolder-backend-module-azure
    Vendor
    Linuxfoundation
    Product
    Backstage\/plugin-scaffolder-backend-module-bitbucket-cloud
    Vendor
    Linuxfoundation
    Product
    Backstage\/plugin-scaffolder-backend-module-bitbucket-server
    Vendor
    Linuxfoundation
    Product
    Backstage\/plugin-scaffolder-backend-module-github
    Vendor
    Linuxfoundation
    Product
    Backstage\/plugin-scaffolder-backend-module-gitlab

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-115923 (CVSS 6.5) — Backstage is an open framework for building developer portals. Prior to 3.9.2 and from 4.0.0 until 4.0.2, Defa…
    CVE-2026-106495 (CVSS 4.3) — Backstage is an open framework for building developer portals. Prior to 0.17.8, the @backstage/backend-default…
    CVE-2026-106557 (CVSS 7.7) — Backstage is an open framework for building developer portals. Prior to 1.14.6 and 1.15.4, the @backstage/plug…
    CVE-2026-106563 (CVSS 5.3) — Backstage is an open framework for building developer portals. Prior to 0.21.8, the @backstage/plugin-kubernet…
    CVE-2026-106562 (CVSS 4.3) — Backstage is an open framework for building developer portals. Prior to 2.1.6 in @backstage/plugin-search-back…
    CVE-2026-106561 (CVSS 5) — Backstage is an open framework for building developer portals. Prior to 0.21.9, the @backstage/plugin-kubernet…
    CVE-2026-106560 (CVSS 7.1) — Backstage is an open framework for building developer portals. Prior to 0.3.25, the @backstage/plugin-scaffold…
    CVE-2026-106559 (CVSS 6.3) — Backstage is an open framework for building developer portals. Prior to 0.3.25, the @backstage/plugin-scaffold…
    CVE-2026-106558 (CVSS 8.8) — Backstage is an open framework for building developer portals. Prior to 1.14.8, 1.15.6, and 2.0.1, the @backst…
    CVE-2026-106556 (CVSS 7.7) — Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High