CVE-2026-106486: Backstage is an open framework for building developer portals

This month

HIGH 8.5WATCHLISTUPGRADEUPGRADEUPGRADE

CVE-2026-106486 is a high-severity flaw (CVSS 8.5) affecting backstage\/plugin-scaffolder-backend-module-bitbucket-cloud, backstage\/plugin-scaffolder-backend-module-bitbucket-server, backstage. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Backstage is an open framework for building developer portals. Prior to 0.3.10 in @backstage/plugin-scaffolder-backend-module-bitbucket-cloud and 0.2.25 in @backstage/plugin-scaffolder-backend-module-bitbucket-server, the Bitbucket pull-request Scaffolder actions did not sufficiently validate filesystem paths. An authenticated user who can execute an eligible template and influence an allowed Bitbucket repository could affect paths outside the ex

Why this priority

High severity
On your watchlist

A fixed release or distro patch exists.

Risk facts

CVSS score	8.5 (High)
Attack vector	Network (remote)
Attack complexity	High
Privileges needed	Low
User interaction	None
EPSS exploit chance	0.3% (top 76%)
CISA exploited list	No
Weakness	CWE-22, CWE-59
Published	2026-10-06
Last modified	2026-10-23

Publisher (CNA): GitHub, Inc. · Vendor: linuxfoundation

Am I affected?

Timeline

2026-10-06 21:17 UTCPublished CVE record published
2026-10-23 15:01 UTCUpdated Record last modified

linuxfoundation backstage\/plugin-scaffolder-backend-module-bitbucket-cloud UPGRADE

Affected: < 0.3.10

Fixed in: 0.3.10

Safe to downgrade to: no unaffected older release

1. Check installed version

npm ls backstageplugin-scaffolder-backend-module-bitbucket-cloud

2. UPGRADE to 0.3.10

npm install backstageplugin-scaffolder-backend-module-bitbucket-cloud@">=0.3.10"

linuxfoundation backstage\/plugin-scaffolder-backend-module-bitbucket-server UPGRADE

Affected: < 0.2.25

Fixed in: 0.2.25

Safe to downgrade to: no unaffected older release

1. Check installed version

npm ls backstageplugin-scaffolder-backend-module-bitbucket-server

2. UPGRADE to 0.2.25

npm install backstageplugin-scaffolder-backend-module-bitbucket-server@">=0.2.25"

linuxfoundation backstage UPGRADE

Affected: < 1.54.6

Fixed in: 1.54.6

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy backstage || rpm -q backstage || backstage --version

2. UPGRADE to 1.54.6 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade backstage

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade backstage

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

Exact fixes by distribution

npm · @backstage/plugin-scaffolder-backend-module-bitbucket-cloud · FIXED · 0.3.10 · vulnerable: < 0.3.10 · source

npm install @backstage/plugin-scaffolder-backend-module-bitbucket-cloud@">=0.3.10" npm ls @backstage/plugin-scaffolder-backend-module-bitbucket-cloud

npm · @backstage/plugin-scaffolder-backend-module-bitbucket-server · FIXED · 0.2.25 · vulnerable: < 0.2.25 · source

npm install @backstage/plugin-scaffolder-backend-module-bitbucket-server@">=0.2.25" npm ls @backstage/plugin-scaffolder-backend-module-bitbucket-server

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Related CVEs

CVE-2026-106462 MEDIUM 6.4 UPGRADE UPGRADE Backstage is an open framework for building developer portals

References

← Back to latest CVEs