CVE-2026-106503 — Vulnerability in...

HIGH

Backstage: Scaffolder action input authorization bypass

Published October 7, 2026Updated October 7, 2026Source: osv

Summary

### Impact An authenticated user with access to affected Scaffolder templates could bypass configured action restrictions. Depending on integration credentials, this could grant unauthorized access to repositories and related source-control resources. ### Patches Patched in `@backstage/plugin-scaffolder-backend` version `4.1.0` ### Workarounds - Restrict affected Scaffolder actions to trusted users and configure source-control integrations with least-privilege credentials.

Advisory Timeline

First published October 7, 2026 (5 days ago).
Last revised October 7, 2026 — 0 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

npm

Update @backstage/plugin-scaffolder-backend to 3.3.1 or later

npm install @backstage/plugin-scaffolder-backend@3.3.1

npm

Update @backstage/plugin-scaffolder-backend to 3.4.1 or later

npm install @backstage/plugin-scaffolder-backend@3.4.1

npm

Update @backstage/plugin-scaffolder-backend to 4.1.0 or later

npm install @backstage/plugin-scaffolder-backend@4.1.0

npm

Update @backstage/plugin-scaffolder-backend to 4.0.3 or later

npm install @backstage/plugin-scaffolder-backend@4.0.3

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (4)

Affects 1 ecosystem: npm (1).

Package	Ecosystem	Affected	Fixed In
@backstage/plugin-scaffolder-backend	npm	All versions	3.3.1
@backstage/plugin-scaffolder-backend	npm	All versions	3.4.1
@backstage/plugin-scaffolder-backend	npm	All versions	4.1.0
@backstage/plugin-scaffolder-backend	npm	All versions	4.0.3

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-178
View on MITRE
CWE-284
View on MITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 8.1 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References

Frequently Asked Questions

What is CVE-2026-106503?: Backstage: Scaffolder action input authorization bypass This vulnerability has been assigned a severity rating of HIGH (CVSS score: 8.1/10).
How do I check if my project is affected by CVE-2026-106503?: CVE-2026-106503 affects @backstage/plugin-scaffolder-backend. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-106503 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

8.1

High exploitability or significant impact. Prioritize remediation within days.

Also Known As

GHSA-hmp2-4m7g-22cv

Related CVEs

CVE-2026-106501
CRITICAL
Backstage: Sensitive information exposure in Scaffolder
CVE-2026-106486
HIGH
Backstage has iImproper filesystem validation in Bitbucket pull-request scaffolder actions
CVE-2026-106558
HIGH
Backstage: Improper validation of TechDocs MkDocs configuration
CVE-2026-107375
HIGH
JHipster: SQL Injection in the Parameter of JHipster-Generated Reactive (WebFlux + R2DBC) Applicationssort
CVE-2026-107384
HIGH
MariaDB Connector/Node.js: SQL injection through object keys in SET expansion (permitSetMultiParamEntries)

More npm advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies