CVE-2026-106462 Backstage: Scaffolder credential handling may allow unintended GitHub authentication fallback
Authenticated users can bypass credential boundaries to perform GitHub operations with broader access than intended in Backstage scaffolder actions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-106462?
CVE-2026-106462 is a medium-severity vulnerability in Linuxfoundation Backstage, published on 6 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Backstage is an open framework for building developer portals. Prior to 1.54.6, scaffolder source-control actions may not consistently enforce intended credential boundaries. An authenticated user could cause an affected action to fall back to broader integration credentials and perform operations with more access than intended. This issue is fixed in 1.54.6 when operators also enable scaffolder.requireScmUserCredentials after upgrading.
Which versions are affected by CVE-2026-106462?
12 open source packages ship an affected version, including @backstage/plugin-scaffolder-backend, @backstage/plugin-scaffolder-backend-module-azure and @backstage/plugin-scaffolder-backend-module-bitbucket-cloud. It affects 7 products.
| Package | Affected | Fixed in |
|---|---|---|
@backstage/plugin-scaffolder-backend npm | All versions | 4.1.0 |
@backstage/plugin-scaffolder-backend npm | All versions | 4.1.0 |
@backstage/plugin-scaffolder-backend-module-azure npm | All versions | 0.2.25 |
@backstage/plugin-scaffolder-backend-module-azure npm | All versions | 0.2.25 |
@backstage/plugin-scaffolder-backend-module-bitbucket-cloud npm | All versions | 0.3.10 |
@backstage/plugin-scaffolder-backend-module-bitbucket-cloud npm | All versions | 0.3.10 |
6 more packages
@backstage/plugin-scaffolder-backend-module-bitbucket-server npm | All versions | 0.2.25 |
@backstage/plugin-scaffolder-backend-module-bitbucket-server npm | All versions | 0.2.25 |
@backstage/plugin-scaffolder-backend-module-github npm | All versions | 0.9.13 |
@backstage/plugin-scaffolder-backend-module-github npm | All versions | 0.9.13 |
@backstage/plugin-scaffolder-backend-module-gitlab npm | All versions | 0.11.10 |
@backstage/plugin-scaffolder-backend-module-gitlab npm | All versions | 0.11.10 |
Products include Linuxfoundation Backstage, Linuxfoundation Backstage\/Plugin-Scaffolder-Backend, Linuxfoundation Backstage\/Plugin-Scaffolder-Backend-Module-Azure, Linuxfoundation Backstage\/Plugin-Scaffolder-Backend-Module-Bitbucket-Cloud, Linuxfoundation Backstage\/Plugin-Scaffolder-Backend-Module-Bitbucket-Server, Linuxfoundation Backstage\/Plugin-Scaffolder-Backend-Module-Github and 1 more.
How do I fix CVE-2026-106462?
Upgrade @backstage/plugin-scaffolder-backend to 4.1.0 or later.
Is CVE-2026-106462 being exploited?
There is no known exploitation of CVE-2026-106462 in the wild and no public exploit code.
Other vulnerabilities in Linuxfoundation Backstage
- CVE-2026-106501 Backstage: Sensitive information exposure in Scaffolder
- CVE-2026-106558 Backstage: Improper validation of TechDocs MkDocs configuration
- CVE-2026-88064 Backstage: Improper input validation in TechDocs MkDocs configuration
- CVE-2026-106459 Backstage: Improper input validation in Sentry scaffolder actions
- CVE-2026-106486 Backstage: Improper filesystem validation in Bitbucket pull-request scaffolder actions
Sources
Also known as GHSA-29gx-h2m3-xw44.