All vulnerabilities
CVE-2026-106503GHSA-hmp2-4m7g-22cv

@backstage/plugin-scaffolder-backend: Backstage: Scaffolder action input authorization bypass

backstage @backstage/plugin-scaffolder-backendnpmLibraries & packages
Open in ThreatlineRecord JSON
CVSS
8.1High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.38%Chance of exploitation activity in the next 30 days, higher than 31% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in3.3.1Also 3.4.1, 4.0.3 and 1 moreGitHub
Published6 Oct 2026Updated 9 Oct 2026CVE List

What fixes it

  • 3.3.1@backstage/plugin-scaffolder-backend, npmGitHubnpm install @backstage/plugin-scaffolder-backend@3.3.1
  • 3.4.1@backstage/plugin-scaffolder-backend, npmGitHubnpm install @backstage/plugin-scaffolder-backend@3.4.1
  • 4.0.3@backstage/plugin-scaffolder-backend, npmGitHubnpm install @backstage/plugin-scaffolder-backend@4.0.3
  • 4.1.0@backstage/plugin-scaffolder-backend, npmGitHubnpm install @backstage/plugin-scaffolder-backend@4.1.0

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Impact

An authenticated user with access to affected Scaffolder templates could bypass configured action restrictions. Depending on integration credentials, this could grant unauthorized access to repositories and related source-control resources.

Patches

Patched in @backstage/plugin-scaffolder-backend version 4.1.0

Workarounds

  • Restrict affected Scaffolder actions to trusted users and configure source-control integrations with least-privilege credentials.

Text from GitHub Advisory Database

Affected versions 15

  • @backstage/plugin-scaffolder-backend, npm< 3.3.1GitHub
  • @backstage/plugin-scaffolder-backend, npm>= 3.4.0, < 3.4.1GitHub
  • @backstage/plugin-scaffolder-backend, npm>= 4.0.0, < 4.0.3GitHub
  • @backstage/plugin-scaffolder-backend, npm>= 4.0.4, < 4.1.0GitHub
  • backstageaffected: < 1.49.6CVE List
  • backstageaffected: >= 1.50.0-next.0, < 1.50.5CVE List
  • backstageaffected: >= 1.51.0-next.0, < 1.54.6CVE List
  • plugin-scaffolder-backendaffected: < 3.3.1CVE List
  • plugin-scaffolder-backendaffected: >= 3.4.0, < 3.4.1CVE List
  • plugin-scaffolder-backendaffected: >= 4.0.0, < 4.0.3CVE List
  • plugin-scaffolder-backendaffected: >= 4.0.4, < 4.1.0CVE List
  • @backstage/plugin-scaffolder-backend, npmfrom first release, fixed in 3.3.1OSV
  • @backstage/plugin-scaffolder-backend, npmfrom 3.4.0, fixed in 3.4.1OSV
  • @backstage/plugin-scaffolder-backend, npmfrom 4.0.0, fixed in 4.0.3OSV
  • @backstage/plugin-scaffolder-backend, npmfrom 4.0.4, fixed in 4.1.0OSV

References 9