CVE-2026-106461 Backstage: Incorrect authorization in scaffolder task listing
Authenticated users can view unauthorized scaffolder task metadata due to incorrect authorization checks in the Backstage plugin.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-106461?
CVE-2026-106461 is a medium-severity missing authorization vulnerability in Linuxfoundation Backstage, published on 6 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by incorrect authorization in scaffolder task listing. An authenticated internal user may be able to view metadata for scaffolder tasks outside the visibility intended by a deployment's permission policy. Stored task secrets are not included in the affected response, and no integrity or availability impact was identified. This issue is fixed in version 4.1.0.
Weakness: CWE-863
Which versions are affected by CVE-2026-106461?
2 open source packages ship an affected version, including @backstage/plugin-scaffolder-backend. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
@backstage/plugin-scaffolder-backend npm | All versions | 4.1.0 |
@backstage/plugin-scaffolder-backend npm | All versions | 4.1.0 |
Products include Linuxfoundation Backstage, Linuxfoundation Backstage\/Plugin-Scaffolder-Backend.
How do I fix CVE-2026-106461?
Upgrade @backstage/plugin-scaffolder-backend to 4.1.0 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-106461 being exploited?
There is no known exploitation of CVE-2026-106461 in the wild and no public exploit code.
Other vulnerabilities in Linuxfoundation Backstage
- CVE-2026-106501 Backstage: Sensitive information exposure in Scaffolder
- CVE-2026-106558 Backstage: Improper validation of TechDocs MkDocs configuration
- CVE-2026-88064 Backstage: Improper input validation in TechDocs MkDocs configuration
- CVE-2026-106459 Backstage: Improper input validation in Sentry scaffolder actions
- CVE-2026-106486 Backstage: Improper filesystem validation in Bitbucket pull-request scaffolder actions
Sources
Also known as GHSA-7hfw-grcm-cqm6.