CVE-2026-106462: backstage < 1.54.6; +6 more affected products

Affected technology

backstage · < 1.54.6
backstage

plugin-scaffolder-backend · < 4.1.0
@backstage

plugin-scaffolder-backend-module-azure · < 0.2.25
@backstage

plugin-scaffolder-backend-module-bitbucket-cloud · < 0.3.10
@backstage

plugin-scaffolder-backend-module-bitbucket-server · < 0.2.25
@backstage

plugin-scaffolder-backend-module-github · < 0.9.13
@backstage

plugin-scaffolder-backend-module-gitlab · < 0.11.10
@backstage

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

An authenticated user could cause an affected action to fall back to broader integration credentials and perform operations with more access than intended. Vendor/CNA’s CVSS 3.1 assessment (base score 6.4/10) rates confidentiality and integrity impact as low; availability impact as none.