CVE-2026-106461: Backstage: Incorrect authorization in scaffolder task listing

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-06 · updated 2026-10-23
Weakness: CWE-863

Description

Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by incorrect authorization in scaffolder task listing. An authenticated internal user may be able to view metadata for scaffolder tasks outside the visibility intended by a deployment's permission policy. Stored task secrets are not included in the affected response, and no integrity or availability impact was identified. This issue is fixed in version 4.1.0.

Affected products

backstage: before 1.54.6 — fixed in 1.54.6
@backstage plugin-scaffolder-backend: before 4.1.0 — fixed in 4.1.0

How to fix

Upgrade to a fixed version: backstage 1.54.6; @backstage plugin-scaffolder-backend 4.1.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-106461 or the next vulnerability affects your stack