Plugin scaffolder backend: Backstage: Incorrect authorization in scaffolder task listing (CVE-2026-106461)
Description
An authorization vulnerability in the @backstage/plugin-scaffolder-backend prior to version 4.1.0 allows an authenticated internal user to view metadata for scaffolder tasks beyond their intended permission scope. The vulnerability does not expose stored task secrets and does not impact data integrity or availability. A patch is available in version 4.1.0. Workarounds include restricting access to the task-list endpoint and avoiding sensitive data in template inputs until patched.
CVSS v3.1
Score 4.3medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-106461 is an incorrect authorization vulnerability in the @backstage/plugin-scaffolder-backend plugin that allows authenticated internal users to view metadata for scaffolder tasks outside the visibility intended by the deployment's permission policy. The vulnerability does not expose stored task secrets and does not affect integrity or availability. It is addressed by updating to version 4.1.0 of the plugin. Mitigations prior to patching include restricting access at the ingress or proxy level and avoiding sensitive input parameters in templates.
Potential Impact
An authenticated internal user may gain unauthorized read access to scaffolder task metadata beyond their permission scope. There is no exposure of stored task secrets, and no impact on data integrity or availability has been identified. The CVSS score is 4.3 (medium severity), reflecting limited confidentiality impact without integrity or availability consequences.
Mitigation Recommendations
Apply the official patch by upgrading to @backstage/plugin-scaffolder-backend version 4.1.0. Until the patch is deployed, restrict access to the scaffolder task-list endpoint at the ingress or authenticating proxy to users authorized to view all tasks. Additionally, avoid placing sensitive values in template input parameters to reduce risk.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-7hfw-grcm-cqm6
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-106461"]
- Ecosystems
- ["npm"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6ac6c0022cdf04f6568291cd
Added to database: 10/07/2026, 21:56:18 UTC
Last enriched: 10/07/2026, 22:15:52 UTC
Last updated: 10/07/2026, 22:15:52 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.