CVE-2026-106461: @backstage/plugin-scaffolder-backend - Incorrect Authorization in Scaffolder Task Listing
Summary
CVE-2026-106461: Backstage: Incorrect authorization in scaffolder task listing. Affects @backstage/plugin-scaffolder-backend versions < 4.1.0. Fixed in 4.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @backstage/plugin-scaffolder-backend package is a core component of the Backstage framework, which is designed to streamline the development process by providing scaffolding capabilities for creating new services and components. This plugin allows users to manage and automate the creation of software components, enhancing productivity and standardization within development teams. However, it has been identified that the plugin has a vulnerability that could expose task metadata to unauthorized users, undermining the intended permission policies.
Vulnerability Detail
The vulnerability arises from an incorrect authorization mechanism in the scaffolder task listing feature of the @backstage/plugin-scaffolder-backend package. An authenticated internal user may gain access to metadata for scaffolder tasks that should be restricted based on the deployment's permission policy. While stored task secrets are not included in the exposed data, the potential for unauthorized access to task metadata poses a moderate risk to the integrity of the system. This issue is classified under CWE-863, which pertains to improper authorization.
How To Fix
Latest published version: 4.2.1 as of 22 Oct 2026
npm install @backstage/plugin-scaffolder-backend@4.2.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.1.0
This is the first release that contains the fix.
npm install @backstage/plugin-scaffolder-backend@4.1.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can restrict access to the scaffolder task-list endpoint at the ingress or authenticating proxy level. This can be done by configuring your proxy settings to allow only users who are permitted to view all tasks. Additionally, avoid placing sensitive values in template input parameters until the patched package is deployed.
Conclusion
The CVE-2026-106461 vulnerability in the @backstage/plugin-scaffolder-backend package highlights the importance of proper authorization mechanisms in software development tools. By updating to the patched version and implementing the suggested workarounds, users can mitigate the risks associated with this vulnerability and maintain the integrity of their applications.
See every vulnerability recorded for @backstage/plugin-scaffolder-backend →
FAQ
CVE-2026-106461 is a vulnerability in the @backstage/plugin-scaffolder-backend package that allows unauthorized access to scaffolder task metadata.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which analyzes your package-lock.json for vulnerabilities.
If an immediate update is not possible, implement the suggested workarounds to restrict access to the task-list endpoint and avoid using sensitive values in template parameters.
The vulnerability has a CVSS score of 4.3, indicating a moderate severity level.
More information can be found in the official advisory on GitHub or by visiting the Vulert website for real-time monitoring of open-source vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for @backstage/plugin-scaffolder-backend.
