CVE-2026-106462

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-106462", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-10-06T16:49:40.591Z", "datePublished": "2026-10-06T20:30:28.855Z", "dateUpdated": "2026-10-07T15:13:57.430Z"}, "containers": {"cna": {"title": "Backstage: Scaffolder credential handling may allow unintended GitHub authentication fallback", "problemTypes": [{"descriptions": [{"cweId": "CWE-441", "lang": "en", "description": "CWE-441: Unintended Proxy or Intermediary ('Confused Deputy')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-863", "lang": "en", "description": "CWE-863: Incorrect Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/backstage/backstage/security/advisories/GHSA-29gx-h2m3-xw44", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/backstage/backstage/security/advisories/GHSA-29gx-h2m3-xw44"}, {"name": "https://github.com/backstage/backstage/commit/6fb2a41ea47da37eafe5ea744050ef90be6820c0", "tags": ["x_refsource_MISC"], "url": "https://github.com/backstage/backstage/commit/6fb2a41ea47da37eafe5ea744050ef90be6820c0"}, {"name": "https://github.com/backstage/backstage/releases/tag/v1.54.6", "tags": ["x_refsource_MISC"], "url": "https://github.com/backstage/backstage/releases/tag/v1.54.6"}], "affected": [{"vendor": "backstage", "product": "backstage", "versions": [{"version": "< 1.54.6", "status": "affected"}]}, {"vendor": "@backstage", "product": "plugin-scaffolder-backend", "versions": [{"version": "< 4.1.0", "status": "affected"}]}, {"vendor": "@backstage", "product": "plugin-scaffolder-backend-module-azure", "versions": [{"version": "< 0.2.25", "status": "affected"}]}, {"vendor": "@backstage", "product": "plugin-scaffolder-backend-module-bitbucket-cloud", "versions": [{"version": "< 0.3.10", "status": "affected"}]}, {"vendor": "@backstage", "product": "plugin-scaffolder-backend-module-bitbucket-server", "versions": [{"version": "< 0.2.25", "status": "affected"}]}, {"vendor": "@backstage", "product": "plugin-scaffolder-backend-module-github", "versions": [{"version": "< 0.9.13", "status": "affected"}]}, {"vendor": "@backstage", "product": "plugin-scaffolder-backend-module-gitlab", "versions": [{"version": "< 0.11.10", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-06T20:30:28.855Z"}, "descriptions": [{"lang": "en", "value": "Backstage is an open framework for building developer portals. Prior to 1.54.6, scaffolder source-control actions may not consistently enforce intended credential boundaries. An authenticated user could cause an affected action to fall back to broader integration credentials and perform operations with more access than intended. This issue is fixed in 1.54.6 when operators also enable scaffolder.requireScmUserCredentials after upgrading."}], "source": {"advisory": "GHSA-29gx-h2m3-xw44", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-07T15:13:05.681052Z", "id": "CVE-2026-106462", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-07T15:13:57.430Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-106462", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-07T15:13:05.681052Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-07T15:13:48.416Z"}}], "cna": {"title": "Backstage: Scaffolder credential handling may allow unintended GitHub authentication fallback", "source": {"advisory": "GHSA-29gx-h2m3-xw44", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "backstage", "product": "backstage", "versions": [{"status": "affected", "version": "< 1.54.6"}]}, {"vendor": "@backstage", "product": "plugin-scaffolder-backend", "versions": [{"status": "affected", "version": "< 4.1.0"}]}, {"vendor": "@backstage", "product": "plugin-scaffolder-backend-module-azure", "versions": [{"status": "affected", "version": "< 0.2.25"}]}, {"vendor": "@backstage", "product": "plugin-scaffolder-backend-module-bitbucket-cloud", "versions": [{"status": "affected", "version": "< 0.3.10"}]}, {"vendor": "@backstage", "product": "plugin-scaffolder-backend-module-bitbucket-server", "versions": [{"status": "affected", "version": "< 0.2.25"}]}, {"vendor": "@backstage", "product": "plugin-scaffolder-backend-module-github", "versions": [{"status": "affected", "version": "< 0.9.13"}]}, {"vendor": "@backstage", "product": "plugin-scaffolder-backend-module-gitlab", "versions": [{"status": "affected", "version": "< 0.11.10"}]}], "references": [{"url": "https://github.com/backstage/backstage/security/advisories/GHSA-29gx-h2m3-xw44", "name": "https://github.com/backstage/backstage/security/advisories/GHSA-29gx-h2m3-xw44", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/backstage/backstage/commit/6fb2a41ea47da37eafe5ea744050ef90be6820c0", "name": "https://github.com/backstage/backstage/commit/6fb2a41ea47da37eafe5ea744050ef90be6820c0", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/backstage/backstage/releases/tag/v1.54.6", "name": "https://github.com/backstage/backstage/releases/tag/v1.54.6", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Backstage is an open framework for building developer portals. Prior to 1.54.6, scaffolder source-control actions may not consistently enforce intended credential boundaries. An authenticated user could cause an affected action to fall back to broader integration credentials and perform operations with more access than intended. This issue is fixed in 1.54.6 when operators also enable scaffolder.requireScmUserCredentials after upgrading."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-441", "description": "CWE-441: Unintended Proxy or Intermediary ('Confused Deputy')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863: Incorrect Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-06T20:30:28.855Z"}}}, "cveMetadata": {"cveId": "CVE-2026-106462", "state": "PUBLISHED", "dateUpdated": "2026-10-07T15:13:57.430Z", "dateReserved": "2026-10-06T16:49:40.591Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-10-06T20:30:28.855Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "backstage", "vendor": "backstage", "versions": [{"status": "affected", "version": "< 1.54.6"}]}, {"product": "plugin-scaffolder-backend", "vendor": "@backstage", "versions": [{"status": "affected", "version": "< 4.1.0"}]}, {"product": "plugin-scaffolder-backend-module-azure", "vendor": "@backstage", "versions": [{"status": "affected", "version": "< 0.2.25"}]}, {"product": "plugin-scaffolder-backend-module-bitbucket-cloud", "vendor": "@backstage", "versions": [{"status": "affected", "version": "< 0.3.10"}]}, {"product": "plugin-scaffolder-backend-module-bitbucket-server", "vendor": "@backstage", "versions": [{"status": "affected", "version": "< 0.2.25"}]}, {"product": "plugin-scaffolder-backend-module-github", "vendor": "@backstage", "versions": [{"status": "affected", "version": "< 0.9.13"}]}, {"product": "plugin-scaffolder-backend-module-gitlab", "vendor": "@backstage", "versions": [{"status": "affected", "version": "< 0.11.10"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:linuxfoundation:backstage\\/plugin-scaffolder-backend:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "554B8EEF-9383-4C89-94CC-6D4E310C401F", "versionEndExcluding": "0.11.10", "vulnerable": true}, {"criteria": "cpe:2.3:a:linuxfoundation:backstage\\/plugin-scaffolder-backend-module-azure:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "0C67C4AA-6610-4536-9CEF-562872DEB622", "versionEndExcluding": "0.2.25", "vulnerable": true}, {"criteria": "cpe:2.3:a:linuxfoundation:backstage\\/plugin-scaffolder-backend-module-bitbucket-cloud:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "51A44535-7A5D-46B0-AC79-5E9DAE726BAE", "versionEndExcluding": "0.3.10", "vulnerable": true}, {"criteria": "cpe:2.3:a:linuxfoundation:backstage\\/plugin-scaffolder-backend-module-bitbucket-server:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "19CE6595-34DE-4124-B304-FDEFCB3FD00B", "versionEndExcluding": "0.2.25", "vulnerable": true}, {"criteria": "cpe:2.3:a:linuxfoundation:backstage\\/plugin-scaffolder-backend-module-github:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "164D0465-E901-496E-81D9-935CA9E23C73", "versionEndExcluding": "0.9.13", "vulnerable": true}, {"criteria": "cpe:2.3:a:linuxfoundation:backstage\\/plugin-scaffolder-backend-module-gitlab:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "B41C96A0-5669-463A-BFC7-B459D29A69D3", "versionEndExcluding": "0.11.10", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*", "matchCriteriaId": "630B6B8B-D515-4FEF-83C7-9CF51C7EB2F5", "versionEndExcluding": "1.54.6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Backstage is an open framework for building developer portals. Prior to 1.54.6, scaffolder source-control actions may not consistently enforce intended credential boundaries. An authenticated user could cause an affected action to fall back to broader integration credentials and perform operations with more access than intended. This issue is fixed in 1.54.6 when operators also enable scaffolder.requireScmUserCredentials after upgrading."}], "id": "CVE-2026-106462", "lastModified": "2026-10-22T18:53:09.440", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-106462", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-07T15:13:05.681052Z", "version": "2.0.3"}}]}, "published": "2026-10-06T21:17:17.020", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/backstage/backstage/commit/6fb2a41ea47da37eafe5ea744050ef90be6820c0"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Release Notes"], "url": "https://github.com/backstage/backstage/releases/tag/v1.54.6"}, {"source": "security-advisories@github.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/backstage/backstage/security/advisories/GHSA-29gx-h2m3-xw44"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-441"}, {"lang": "en", "value": "CWE-863"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "backstage: Backstage: Privilege escalation via improper credential boundary enforcement", "id": "2547184", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2547184"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "status": "draft"}, "cwe": "CWE-250", "details": ["Backstage is an open framework for building developer portals. Prior to 1.54.6, scaffolder source-control actions may not consistently enforce intended credential boundaries. An authenticated user could cause an affected action to fall back to broader integration credentials and perform operations with more access than intended. This issue is fixed in 1.54.6 when operators also enable scaffolder.requireScmUserCredentials after upgrading.", "A flaw was found in Backstage. An authenticated user can cause source-control actions in the scaffolder component to fall back to broader integration credentials due to improper credential boundary enforcement. This issue allows the user to achieve privilege escalation by performing unauthorized operations with higher access permissions than intended."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-106462", "package_state": [{"cpe": "cpe:/a:redhat:rhdh:1", "fix_state": "Fix deferred", "package_name": "rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend", "product_name": "Red Hat Developer Hub"}, {"cpe": "cpe:/a:redhat:rhdh:1", "fix_state": "Fix deferred", "package_name": "rhdh/rhdh-hub-rhel9", "product_name": "Red Hat Developer Hub"}, {"cpe": "cpe:/a:redhat:ansible_portal:2", "fix_state": "Fix deferred", "package_name": "ansible-automation-platform/automation-portal", "product_name": "Self-service automation portal 2"}, {"cpe": "cpe:/a:redhat:ansible_portal:2", "fix_state": "Fix deferred", "package_name": "ansible-automation-platform/bootc-automation-portal-rhel9", "product_name": "Self-service automation portal 2"}], "public_date": "2026-10-06T20:30:28Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-106462\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-106462\nhttps://github.com/backstage/backstage/commit/6fb2a41ea47da37eafe5ea744050ef90be6820c0\nhttps://github.com/backstage/backstage/releases/tag/v1.54.6\nhttps://github.com/backstage/backstage/security/advisories/GHSA-29gx-h2m3-xw44"], "statement": "Red Hat rates this vulnerability as Moderate because exploitation requires authenticated access to developer portal instances configured with source-control management workflows, limiting exposure to registered users. Within Red Hat Developer Hub and Ansible Automation Platform deployments, improper boundary enforcement during automated scaffolding tasks can allow a user's action to inherit higher-privileged shared integration tokens. The impact is primarily restricted to unauthorized repository operations or data access governed by those shared credentials rather than underlying host system compromise.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.54.6)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "backstage", "source": "cna", "vendor": "backstage"}, "product": "backstage", "vendor": "backstage"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.1.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "plugin-scaffolder-backend", "source": "cna", "vendor": "@backstage"}, "product": "plugin-scaffolder-backend", "vendor": "backstage"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.2.25)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "plugin-scaffolder-backend-module-azure", "source": "cna", "vendor": "@backstage"}, "product": "plugin-scaffolder-backend-module-azure", "vendor": "backstage"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.3.10)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "plugin-scaffolder-backend-module-bitbucket-cloud", "source": "cna", "vendor": "@backstage"}, "product": "plugin-scaffolder-backend-module-bitbucket-cloud", "vendor": "backstage"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.2.25)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "plugin-scaffolder-backend-module-bitbucket-server", "source": "cna", "vendor": "@backstage"}, "product": "plugin-scaffolder-backend-module-bitbucket-server", "vendor": "backstage"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.9.13)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "plugin-scaffolder-backend-module-github", "source": "cna", "vendor": "@backstage"}, "product": "plugin-scaffolder-backend-module-github", "vendor": "backstage"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.11.10)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "plugin-scaffolder-backend-module-gitlab", "source": "cna", "vendor": "@backstage"}, "product": "plugin-scaffolder-backend-module-gitlab", "vendor": "backstage"}], "created": "2026-10-07T00:15:07.175808+00:00", "updated": "2026-10-09T08:31:38.839858+00:00", "vendors": ["backstage", "backstage$PRODUCT$backstage", "backstage$PRODUCT$plugin-scaffolder-backend", "backstage$PRODUCT$plugin-scaffolder-backend-module-azure", "backstage$PRODUCT$plugin-scaffolder-backend-module-bitbucket-cloud", "backstage$PRODUCT$plugin-scaffolder-backend-module-bitbucket-server", "backstage$PRODUCT$plugin-scaffolder-backend-module-github", "backstage$PRODUCT$plugin-scaffolder-backend-module-gitlab"]}