Is CVE-2026-106462 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-106462 being exploited in the wild.

How severe is CVE-2026-106462?

Medium severity, with a CVSS score of 6.4, published 6 October 2026.

Which products and versions are affected?

@backstage/plugin-scaffolder-backend (npm) < 4.1.0, SEMVER:introduced=0,fixed=4.1.0; @backstage/plugin-scaffolder-backend-module-azure (npm) < 0.2.25, SEMVER:introduced=0,fixed=0.2.25; @backstage/plugin-scaffolder-backend-module-bitbucket-cloud (npm) < 0.3.10, SEMVER:introduced=0,fixed=0.3.10; @backstage/plugin-scaffolder-backend-module-bitbucket-server (npm) < 0.2.25, SEMVER:introduced=0,fixed=0.2.25; and 3 more.

Is there a fix for CVE-2026-106462?

Yes. @backstage/plugin-scaffolder-backend (npm): upgrade to 4.1.0 or later; @backstage/plugin-scaffolder-backend-module-azure (npm): upgrade to 0.2.25 or later; @backstage/plugin-scaffolder-backend-module-bitbucket-cloud (npm): upgrade to 0.3.10 or later; @backstage/plugin-scaffolder-backend-module-bitbucket-server (npm): upgrade to 0.2.25 or later; @backstage/plugin-scaffolder-backend-module-github (npm): upgrade to 0.9.13 or later; @backstage/plugin-scaffolder-backend-module-gitlab (npm): upgrade to 0.11.10 or later. Until then: After upgrading to version 1.54.6, enable the scaffolder.requireScmUserCredentials configuration setting to enforce user-provided credentials for supported GitHub, GitLab, Bitbucket, and Azure DevOps actions. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-106462 attacked?

It is attacked over the network.

Am I affected by CVE-2026-106462?

Check whether you run @backstage/plugin-scaffolder-backend (npm), @backstage/plugin-scaffolder-backend-module-azure (npm), @backstage/plugin-scaffolder-backend-module-bitbucket-cloud (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-106462: Backstage scaffolder credential boundary enforcement bypass

Q: Is there a fix for CVE-2026-106462?

Yes. @backstage/plugin-scaffolder-backend (npm): upgrade to 4.1.0 or later; @backstage/plugin-scaffolder-backend-module-azure (npm): upgrade to 0.2.25 or later; @backstage/plugin-scaffolder-backend-module-bitbucket-cloud (npm): upgrade to 0.3.10 or later; @backstage/plugin-scaffolder-backend-module-bitbucket-server (npm): upgrade to 0.2.25 or later; @backstage/plugin-scaffolder-backend-module-github (npm): upgrade to 0.9.13 or later; @backstage/plugin-scaffolder-backend-module-gitlab (npm): upgrade to 0.11.10 or later. Until then: After upgrading to version 1.54.6, enable the scaffolder.requireScmUserCredentials configuration setting to enforce user-provided credentials for supported GitHub, GitLab, Bitbucket, and Azure DevOps actions. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-106462 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2026-106462?

Check whether you run @backstage/plugin-scaffolder-backend (npm), @backstage/plugin-scaffolder-backend-module-azure (npm), @backstage/plugin-scaffolder-backend-module-bitbucket-cloud (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-106462 · Severity: medium · CVSS 6.4 · Published 2026-10-06

Backstage is an open framework for building developer portals that helps teams create internal dashboards and workflows. In versions prior to 1.54.6, scaffolder source-control actions may improperly fall back to broader integration credentials, allowing an authenticated user to perform operations with more permissions than intended. An attacker could exploit this to access systems or repositories beyond their intended scope. This is fixed in version 1.54.6 when operators also enable the scaffolder.requireScmUserCredentials configuration.

Technologies: @backstage/plugin-scaffolder-backend (npm), Spotify Backstage. Vendors: npm, Spotify.

Quick answers

Is CVE-2026-106462 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-106462 being exploited in the wild.
How severe is CVE-2026-106462?: Medium severity, with a CVSS score of 6.4, published 6 October 2026.
Which products and versions are affected?: @backstage/plugin-scaffolder-backend (npm) < 4.1.0, SEMVER:introduced=0,fixed=4.1.0; @backstage/plugin-scaffolder-backend-module-azure (npm) < 0.2.25, SEMVER:introduced=0,fixed=0.2.25; @backstage/plugin-scaffolder-backend-module-bitbucket-cloud (npm) < 0.3.10, SEMVER:introduced=0,fixed=0.3.10; @backstage/plugin-scaffolder-backend-module-bitbucket-server (npm) < 0.2.25, SEMVER:introduced=0,fixed=0.2.25; and 3 more.
Is there a fix for CVE-2026-106462?: Yes. @backstage/plugin-scaffolder-backend (npm): upgrade to 4.1.0 or later; @backstage/plugin-scaffolder-backend-module-azure (npm): upgrade to 0.2.25 or later; @backstage/plugin-scaffolder-backend-module-bitbucket-cloud (npm): upgrade to 0.3.10 or later; @backstage/plugin-scaffolder-backend-module-bitbucket-server (npm): upgrade to 0.2.25 or later; @backstage/plugin-scaffolder-backend-module-github (npm): upgrade to 0.9.13 or later; @backstage/plugin-scaffolder-backend-module-gitlab (npm): upgrade to 0.11.10 or later. Until then: After upgrading to version 1.54.6, enable the scaffolder.requireScmUserCredentials configuration setting to enforce user-provided credentials for supported GitHub, GitLab, Bitbucket, and Azure DevOps actions. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-106462 attacked?: It is attacked over the network.
Am I affected by CVE-2026-106462?: Check whether you run @backstage/plugin-scaffolder-backend (npm), @backstage/plugin-scaffolder-backend-module-azure (npm), @backstage/plugin-scaffolder-backend-module-bitbucket-cloud (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@backstage/plugin-scaffolder-backend (npm): upgrade to 4.1.0 or later
```
npm install @backstage/plugin-scaffolder-backend@4.1.0
```
@backstage/plugin-scaffolder-backend-module-azure (npm): upgrade to 0.2.25 or later
```
npm install @backstage/plugin-scaffolder-backend-module-azure@0.2.25
```
@backstage/plugin-scaffolder-backend-module-bitbucket-cloud (npm): upgrade to 0.3.10 or later
```
npm install @backstage/plugin-scaffolder-backend-module-bitbucket-cloud@0.3.10
```
@backstage/plugin-scaffolder-backend-module-bitbucket-server (npm): upgrade to 0.2.25 or later
```
npm install @backstage/plugin-scaffolder-backend-module-bitbucket-server@0.2.25
```
@backstage/plugin-scaffolder-backend-module-github (npm): upgrade to 0.9.13 or later
```
npm install @backstage/plugin-scaffolder-backend-module-github@0.9.13
```
@backstage/plugin-scaffolder-backend-module-gitlab (npm): upgrade to 0.11.10 or later
```
npm install @backstage/plugin-scaffolder-backend-module-gitlab@0.11.10
```

After upgrading to version 1.54.6, enable the scaffolder.requireScmUserCredentials configuration setting to enforce user-provided credentials for supported GitHub, GitLab, Bitbucket, and Azure DevOps actions.

Technical details

The vulnerability exists in scaffolder source-control actions that do not consistently enforce intended credential boundaries. An authenticated user can trigger a fallback to broader integration credentials, allowing them to perform operations with elevated privileges. The fix requires both upgrading to version 1.54.6 and enabling the scaffolder.requireScmUserCredentials configuration option, which enforces the use of user-provided credentials for GitHub, GitLab, Bitbucket, and Azure DevOps mutation actions.

Affected products

Spotify Backstage prior to 1.54.6

Identifiers

CVE-2026-106462
GHSA-29gx-h2m3-xw44

Timeline

2026-10-06: disclosed
2026-08-28: patched: Version 1.54.6 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.