Vulnerability-Lookup

GHSA-29GX-H2M3-XW44

Vulnerability from github – Published: 2026-10-07 18:01 – Updated: 2026-10-07 18:01

Summary

Backstage's scaffolder credential handling may allow unintended GitHub authentication fallback

Details

Impact

Scaffolder actions that interact with source control systems may not consistently enforce the intended credential boundaries under certain configurations. An authenticated user could perform operations with broader access than intended.

Patches

@backstage/plugin-scaffolder-backend version 4.1.0
@backstage/plugin-scaffolder-backend-module-azure version 0.2.25
@backstage/plugin-scaffolder-backend-module-bitbucket-cloud version 0.3.10
@backstage/plugin-scaffolder-backend-module-bitbucket-server version 0.2.25
@backstage/plugin-scaffolder-backend-module-github version 0.9.13
@backstage/plugin-scaffolder-backend-module-gitlab version 0.11.10

The fix introduces a new configuration option that enforces user-provided credentials for supported SCM actions. The new behavior is opt-in for compatibility. After upgrading, set:

scaffolder:
  requireScmUserCredentials: true

Before enabling this setting, review and update your templates as described in the software templates documentation referred to below.

Workarounds

If you cannot upgrade and enable the setting immediately:

Restrict who can create Scaffolder tasks and which templates they can execute.
Limit SCM integration credentials to the minimum repository read and mutation permissions required.
Remove integration credentials for SCM hosts where all required operations can use explicitly supplied user tokens.

Severity

6.4 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@backstage/plugin-scaffolder-backend"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.1.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@backstage/plugin-scaffolder-backend-module-github"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.9.13"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@backstage/plugin-scaffolder-backend-module-gitlab"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.11.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@backstage/plugin-scaffolder-backend-module-azure"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.2.25"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@backstage/plugin-scaffolder-backend-module-bitbucket-cloud"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.3.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@backstage/plugin-scaffolder-backend-module-bitbucket-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.2.25"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-106462"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-441",
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-07T18:01:53Z",
    "nvd_published_at": "2026-10-06T21:17:17Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nScaffolder actions that interact with source control systems may not consistently enforce the intended credential boundaries under certain configurations. An authenticated user could perform operations with broader access than intended.\n\n### Patches\n\n- `@backstage/plugin-scaffolder-backend` version `4.1.0`\n- `@backstage/plugin-scaffolder-backend-module-azure` version `0.2.25`\n- `@backstage/plugin-scaffolder-backend-module-bitbucket-cloud` version `0.3.10`\n- `@backstage/plugin-scaffolder-backend-module-bitbucket-server` version `0.2.25`\n- `@backstage/plugin-scaffolder-backend-module-github` version `0.9.13`\n- `@backstage/plugin-scaffolder-backend-module-gitlab` version `0.11.10`\n\nThe fix introduces a new configuration option that enforces user-provided credentials for supported SCM actions. The new behavior is opt-in for compatibility. After upgrading, set:\n\n```yaml\nscaffolder:\n  requireScmUserCredentials: true\n```\n\nBefore enabling this setting, review and update your templates as described in the software templates documentation referred to below.\n\n### Workarounds\n\nIf you cannot upgrade and enable the setting immediately:\n\n- Restrict who can create Scaffolder tasks and which templates they can execute.\n- Limit SCM integration credentials to the minimum repository read and mutation permissions required.\n- Remove integration credentials for SCM hosts where all required operations can use explicitly supplied user tokens.",
  "id": "GHSA-29gx-h2m3-xw44",
  "modified": "2026-10-07T18:01:54Z",
  "published": "2026-10-07T18:01:53Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/backstage/backstage/security/advisories/GHSA-29gx-h2m3-xw44"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106462"
    },
    {
      "type": "WEB",
      "url": "https://github.com/backstage/backstage/commit/6fb2a41ea47da37eafe5ea744050"
    },
    {
      "type": "WEB",
      "url": "https://github.com/backstage/backstage/commit/6fb2a41ea47da37eafe5ea744050ef90be6820c0"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/backstage/backstage"
    },
    {
      "type": "WEB",
      "url": "https://github.com/backstage/backstage/releases/tag/v1.54.6"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Backstage\u0027s scaffolder credential handling may allow unintended GitHub authentication fallback"
}

CVE-2026-106462 (GCVE-0-2026-106462)

Vulnerability from cvelistv5 – Published: 2026-10-06 20:30 – Updated: 2026-10-07 15:13

Title

Backstage: Scaffolder credential handling may allow unintended GitHub authentication fallback

Summary

Backstage is an open framework for building developer portals. Prior to 1.54.6, scaffolder source-control actions may not consistently enforce intended credential boundaries. An authenticated user could cause an affected action to fall back to broader integration credentials and perform operations with more access than intended. This issue is fixed in 1.54.6 when operators also enable scaffolder.requireScmUserCredentials after upgrading.

Severity

6.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-07 15:13 UTC

CWE

CWE-441 - Unintended Proxy or Intermediary ('Confused Deputy')
CWE-863 - Incorrect Authorization

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7580 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/backstage/backstage/security/a…	x_refsource_CONFIRM
https://github.com/backstage/backstage/commit/6fb…	x_refsource_MISC
https://github.com/backstage/backstage/releases/t…	x_refsource_MISC

Impacted products

7 products

Vendor	Product	Version
backstage	backstage	Affected: < 1.54.6
@backstage	plugin-scaffolder-backend	Affected: < 4.1.0
@backstage	plugin-scaffolder-backend-module-azure	Affected: < 0.2.25
@backstage	plugin-scaffolder-backend-module-bitbucket-cloud	Affected: < 0.3.10
@backstage	plugin-scaffolder-backend-module-bitbucket-server	Affected: < 0.2.25
@backstage	plugin-scaffolder-backend-module-github	Affected: < 0.9.13
@backstage	plugin-scaffolder-backend-module-gitlab	Affected: < 0.11.10

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-106462",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-07T15:13:05.681052Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-07T15:13:57.430Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "backstage",
          "vendor": "backstage",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.54.6"
            }
          ]
        },
        {
          "product": "plugin-scaffolder-backend",
          "vendor": "@backstage",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.1.0"
            }
          ]
        },
        {
          "product": "plugin-scaffolder-backend-module-azure",
          "vendor": "@backstage",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.2.25"
            }
          ]
        },
        {
          "product": "plugin-scaffolder-backend-module-bitbucket-cloud",
          "vendor": "@backstage",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.3.10"
            }
          ]
        },
        {
          "product": "plugin-scaffolder-backend-module-bitbucket-server",
          "vendor": "@backstage",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.2.25"
            }
          ]
        },
        {
          "product": "plugin-scaffolder-backend-module-github",
          "vendor": "@backstage",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.9.13"
            }
          ]
        },
        {
          "product": "plugin-scaffolder-backend-module-gitlab",
          "vendor": "@backstage",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.11.10"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Backstage is an open framework for building developer portals. Prior to 1.54.6, scaffolder source-control actions may not consistently enforce intended credential boundaries. An authenticated user could cause an affected action to fall back to broader integration credentials and perform operations with more access than intended. This issue is fixed in 1.54.6 when operators also enable scaffolder.requireScmUserCredentials after upgrading."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-441",
              "description": "CWE-441: Unintended Proxy or Intermediary (\u0027Confused Deputy\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-06T20:30:28.855Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/backstage/backstage/security/advisories/GHSA-29gx-h2m3-xw44",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/backstage/backstage/security/advisories/GHSA-29gx-h2m3-xw44"
        },
        {
          "name": "https://github.com/backstage/backstage/commit/6fb2a41ea47da37eafe5ea744050ef90be6820c0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/backstage/backstage/commit/6fb2a41ea47da37eafe5ea744050ef90be6820c0"
        },
        {
          "name": "https://github.com/backstage/backstage/releases/tag/v1.54.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/backstage/backstage/releases/tag/v1.54.6"
        }
      ],
      "source": {
        "advisory": "GHSA-29gx-h2m3-xw44",
        "discovery": "UNKNOWN"
      },
      "title": "Backstage: Scaffolder credential handling may allow unintended GitHub authentication fallback"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-106462",
    "datePublished": "2026-10-06T20:30:28.855Z",
    "dateReserved": "2026-10-06T16:49:40.591Z",
    "dateUpdated": "2026-10-07T15:13:57.430Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted