« Volver al listado

CVE-2026-106461

Estado: RecibidaMedia (4.3)—

Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by incorrect authorization in scaffolder task listing. An authenticated internal user may be able to view metadata for scaffolder tasks outside the visibility intended by a deployment's permission policy. Stored task secrets are not included in the affected response, and no integrity or availability impact was identified. This issue is fixed in version 4.1.0.

CVSS

Probabilidad de explotación (EPSS)

FIRST aún no ha puntuado esta CVE (habitual en CVEs muy recientes o rechazadas).

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Usuario autenticado accede a metadatos de tareas sin autorización debida (CWE-863). AV:N/PR:L indica red con privilegios; T1210 + lectura de datos no autorizada (T1005).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Vulnerability ScanningThreat Intelligence ProgramPrivileged Account ManagementNetwork SegmentationDisable or Remove Feature or ProgramApplication Isolation and Sandboxing

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Backstage — Plugin Scaffolder BackendAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-106461",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "backstage",
          "product": "backstage",
          "versions": [
            {
              "status": "affected",
              "version": "< 1.54.6"
            }
          ]
        },
        {
          "vendor": "@backstage",
          "product": "plugin-scaffolder-backend",
          "versions": [
            {
              "status": "affected",
              "version": "< 4.1.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-10-06T21:17:16.870",
  "references": [
    {
      "url": "https://github.com/backstage/backstage/commit/0253c50673f2832b0b1e9f73348186434e7bd09e",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/backstage/backstage/releases/tag/v1.54.6",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/backstage/backstage/security/advisories/GHSA-7hfw-grcm-cqm6",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by incorrect authorization in scaffolder task listing. An authenticated internal user may be able to view metadata for scaffolder tasks outside the visibility intended by a deployment's permission policy. Stored task secrets are not included in the affected response, and no integrity or availability impact was identified. This issue is fixed in version 4.1.0."
    }
  ],
  "lastModified": "2026-10-06T21:17:16.870",
  "sourceIdentifier": "security-advisories@github.com"
}