Free and open · new CVEs checked every 20 minutesStatusRSSOpen dataContact

CVE-2026-106462: Backstage is an open framework for building developer portals

29
Routine
MEDIUM 6.4WATCHLISTUPGRADEUPGRADEUPGRADE

CVE-2026-106462 is a medium-severity flaw (CVSS 6.4) affecting backstage\/plugin-scaffolder-backend, backstage\/plugin-scaffolder-backend-module-azure, backstage\/plugin-scaffolder-backend-module-bitbucket-cloud. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Backstage is an open framework for building developer portals. Prior to 1.54.6, scaffolder source-control actions may not consistently enforce intended credential boundaries. An authenticated user could cause an affected action to fall back to broader integration credentials and perform operations with more access than intended. This issue is fixed in 1.54.6 when operators also enable scaffolder.requireScmUserCredentials after upgrading.

Why this priority

  • On your watchlist

A fixed release or distro patch exists.

Risk facts

CVSS score6.4 (Medium)
Attack vectorNetwork (remote)
Attack complexityLow
Privileges neededLow
User interactionNone
EPSS exploit chance0.2% (top 94%)
CISA exploited listNo
WeaknessCWE-441, CWE-863
Published2026-10-06
Last modified2026-10-22
Publisher (CNA): GitHub, Inc. · Vendor: linuxfoundation

Last updated 2026-10-22 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

linuxfoundation backstage\/plugin-scaffolder-backend UPGRADE
Affected: < 0.11.10
Fixed in: 0.11.10
Safe to downgrade to: no unaffected older release
1. Check installed version
npm ls backstageplugin-scaffolder-backend
2. UPGRADE to 0.11.10
npm install backstageplugin-scaffolder-backend@">=0.11.10"
linuxfoundation backstage\/plugin-scaffolder-backend-module-azure UPGRADE
Affected: < 0.2.25
Fixed in: 0.2.25
Safe to downgrade to: no unaffected older release
1. Check installed version
npm ls backstageplugin-scaffolder-backend-module-azure
2. UPGRADE to 0.2.25
npm install backstageplugin-scaffolder-backend-module-azure@">=0.2.25"
linuxfoundation backstage\/plugin-scaffolder-backend-module-bitbucket-cloud UPGRADE
Affected: < 0.3.10
Fixed in: 0.3.10
Safe to downgrade to: no unaffected older release
1. Check installed version
npm ls backstageplugin-scaffolder-backend-module-bitbucket-cloud
2. UPGRADE to 0.3.10
npm install backstageplugin-scaffolder-backend-module-bitbucket-cloud@">=0.3.10"
linuxfoundation backstage\/plugin-scaffolder-backend-module-bitbucket-server UPGRADE
Affected: < 0.2.25
Fixed in: 0.2.25
Safe to downgrade to: no unaffected older release
1. Check installed version
npm ls backstageplugin-scaffolder-backend-module-bitbucket-server
2. UPGRADE to 0.2.25
npm install backstageplugin-scaffolder-backend-module-bitbucket-server@">=0.2.25"
linuxfoundation backstage\/plugin-scaffolder-backend-module-github UPGRADE
Affected: < 0.9.13
Fixed in: 0.9.13
Safe to downgrade to: no unaffected older release
1. Check installed version
npm ls backstageplugin-scaffolder-backend-module-github
2. UPGRADE to 0.9.13
npm install backstageplugin-scaffolder-backend-module-github@">=0.9.13"
linuxfoundation backstage\/plugin-scaffolder-backend-module-gitlab UPGRADE
Affected: < 0.11.10
Fixed in: 0.11.10
Safe to downgrade to: no unaffected older release
1. Check installed version
npm ls backstageplugin-scaffolder-backend-module-gitlab
2. UPGRADE to 0.11.10
npm install backstageplugin-scaffolder-backend-module-gitlab@">=0.11.10"
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2026-106462?

backstage\/plugin-scaffolder-backend: upgrade to 0.11.10; backstage\/plugin-scaffolder-backend-module-azure: upgrade to 0.2.25; backstage\/plugin-scaffolder-backend-module-bitbucket-cloud: upgrade to 0.3.10. Exact commands for each OS are on this page.

Is CVE-2026-106462 being exploited?

CVE-2026-106462 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2026-106462 affect?

CVE-2026-106462 affects backstage\/plugin-scaffolder-backend, backstage\/plugin-scaffolder-backend-module-azure, backstage\/plugin-scaffolder-backend-module-bitbucket-cloud. Severity is medium (CVSS 6.4). Backstage is an open framework for building developer portals. Prior to 1.54.6, scaffolder source-control actions may not consistently enforce intended credential boundaries. An authenticated user could cause an affected action to fall back

How urgent is CVE-2026-106462?

Priority 29/100. On your watchlist

Software pages

GitLab vulnerabilities · GitHub vulnerabilities · Azure vulnerabilities · Bitbucket vulnerabilities

Related CVEs

References

← Back to latest CVEs