Plugin scaffolder backend: Backstage's scaffolder credential handling may allow unintended GitHub authentication fallback (CVE-2026-106462)
Description
A vulnerability in Backstage's plugin-scaffolder-backend may allow authenticated users to perform source control operations with broader access than intended due to inconsistent enforcement of credential boundaries. This affects scaffolder actions interacting with source control management (SCM) systems. A fix is available in version 4.1.0 and related module versions, introducing an opt-in configuration to enforce user-provided credentials. Until upgraded, restricting task creation and limiting SCM credentials can mitigate risk.
CVSS v3.1
Score 6.4medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-106462 describes a vulnerability in the @backstage/plugin-scaffolder-backend and its SCM modules where scaffolder actions may not consistently enforce credential boundaries under certain configurations. This can result in an authenticated user performing operations with more access than intended, potentially leading to unauthorized source control actions. The issue affects multiple SCM backend modules including GitHub, GitLab, Bitbucket Cloud, Bitbucket Server, and Azure. The vendor released patches in versions 4.1.0 (core plugin) and corresponding module versions. The fix introduces a new opt-in configuration setting 'requireScmUserCredentials' that enforces the use of user-provided credentials for SCM actions, improving access control.
Potential Impact
An authenticated user could perform source control operations with broader access than intended, potentially leading to unauthorized repository modifications or data exposure. The impact is limited to scenarios where credential boundaries are not properly enforced in scaffolder actions. The CVSS score is 6.4 (medium severity) reflecting network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and low confidentiality and integrity impact with no availability impact.
Mitigation Recommendations
A patch is available and should be applied by upgrading to @backstage/plugin-scaffolder-backend version 4.1.0 and the specified module versions. After upgrading, enable the new configuration option 'scaffolder.requireScmUserCredentials: true' to enforce user-provided credentials. Before enabling, review and update scaffolder templates as per vendor documentation. If immediate upgrade is not possible, mitigate by restricting who can create scaffolder tasks and which templates they can execute, limiting SCM integration credentials to minimal necessary permissions, and removing integration credentials for SCM hosts where user tokens suffice.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-29gx-h2m3-xw44
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-106462"]
- Ecosystems
- ["npm"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6ac6bfff2cdf04f6568291a9
Added to database: 10/07/2026, 21:56:15 UTC
Last enriched: 10/07/2026, 22:14:06 UTC
Last updated: 10/07/2026, 22:14:06 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.