VulnerabilityAnalyzed

CVE-2026-106462

Backstage is an open framework for building developer portals.

MEDIUM 6.4EPSS 0.17%

Does this matter?

Lower severity and a low EPSS score (0.17%). Track it; it rarely justifies an emergency change on its own.

Description

Backstage is an open framework for building developer portals. Prior to 1.54.6, scaffolder source-control actions may not consistently enforce intended credential boundaries. An authenticated user could cause an affected action to fall back to broader integration credentials and perform operations with more access than intended. This issue is fixed in 1.54.6 when operators also enable scaffolder.requireScmUserCredentials after upgrading.

CVSS 3.1: 6.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
EPSS: 0.17% probability · 7th percentile
Public exploits: None in Exploit-DB
CISA KEV: Not listed
Weakness: CWE-441, CWE-863
Affected: linuxfoundation/backstage\/plugin-scaffolder-backend · linuxfoundation/backstage\/plugin-scaffolder-backend-module-azure · linuxfoundation/backstage\/plugin-scaffolder-backend-module-bitbucket-cloud · linuxfoundation/backstage\/plugin-scaffolder-backend-module-bitbucket-server · linuxfoundation/backstage\/plugin-scaffolder-backend-module-github · linuxfoundation/backstage\/plugin-scaffolder-backend-module-gitlab · linuxfoundation/backstage
Source: security-advisories@github.com

EPSS trend

EPSS moved from 0.2% on 7 October 2026 to 0.2% on 26 October 2026.

References

https://github.com/backstage/backstage/commit/6fb2a41ea47da37eafe5ea744050ef90be6820c0Patch
https://github.com/backstage/backstage/releases/tag/v1.54.6Patch, Release Notes
https://github.com/backstage/backstage/security/advisories/GHSA-29gx-h2m3-xw44Mitigation, Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.