« Volver al listado

CVE-2026-24046

Estado: AplazadaAlta (7.1)—

Backstage is an open framework for building developer portals. Multiple Scaffolder actions and archive extraction utilities were vulnerable to symlink-based path traversal attacks. An attacker with access to create and execute Scaffolder templates could exploit symlinks to read arbitrary files via the `debug:log` action by creating a symlink pointing to sensitive files (e.g., `/etc/passwd`, configuration files, secrets); delete arbitrary files via the `fs:delete` action by creating symlinks pointing outside the workspace, and write files outside the workspace via archive extraction (tar/zip) containing malicious symlinks. This affects any Backstage deployment where users can create or execute Scaffolder templates. This vulnerability is fixed in `@backstage/backend-defaults` versions 0.12.2, 0.13.2, 0.14.1, and 0.15.0; `@backstage/plugin-scaffolder-backend` versions 2.2.2, 3.0.2, and 3.1.1; and `@backstage/plugin-scaffolder-node` versions 0.11.2 and 0.12.3. Users should upgrade to these versions or later. Some workarounds are available. Follow the recommendation in the Backstage Threat Model to limit access to creating and updating templates, restrict who can create and execute Scaffolder templates using the permissions framework, audit existing templates for symlink usage, and/or run Backstage in a containerized environment with limited filesystem access.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Acceso local privilegiado (PR:L) a servicios remotos Scaffolder. Lectura de archivos sensibles vía symlinks en debug:log (T1005), eliminación de archivos arbitrarios (T1565.001) y escritura fuera del workspace en extracciones de archivo (T1490).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Vulnerability ScanningUser Account ManagementThreat Intelligence ProgramRestrict File and Directory PermissionsPrivileged Account ManagementOperating System Configuration

Tecnologías afectadas (3)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Backstage — Backend-defaultsAIBackstage — Plugin-scaffolder-backendAIBackstage — Plugin-scaffolder-nodeAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-24046",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-24046",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-01-22T15:09:21.771684Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 7.1,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:L",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "LOW",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 4.7,
        "exploitabilityScore": 1.8
      },
      {
        "type": "Secondary",
        "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 9.1,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.3,
        "exploitabilityScore": 3.1
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "backstage",
          "product": "backstage",
          "versions": [
            {
              "status": "affected",
              "version": "@backstage/backend-defaults < 0.12.2"
            },
            {
              "status": "affected",
              "version": "@backstage/backend-defaults >= 0.13.0, < 0.13.2"
            },
            {
              "status": "affected",
              "version": "@backstage/backend-defaults >= 0.14.0, < 0.14.1"
            },
            {
              "status": "affected",
              "version": "@backstage/plugin-scaffolder-backend < 2.2.2"
            },
            {
              "status": "affected",
              "version": "@backstage/plugin-scaffolder-backend >= 3.0.0, < 3.0.2"
            },
            {
              "status": "affected",
              "version": "@backstage/plugin-scaffolder-backend >= 3.1.0, < 3.1.1"
            },
            {
              "status": "affected",
              "version": "@backstage/plugin-scaffolder-node < 0.11.2"
            },
            {
              "status": "affected",
              "version": "@backstage/plugin-scaffolder-node >= 0.12.0, < 0.12.3"
            }
          ]
        }
      ]
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "affectedData": [
        {
          "cpes": [
            "cpe:/a:redhat:rhdh:1.8::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Developer Hub 1.8",
          "versions": [
            {
              "status": "unaffected",
              "version": "1774545605",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "rhdh/rhdh-hub-rhel9",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:rhdh:1.9::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Developer Hub 1.9",
          "versions": [
            {
              "status": "unaffected",
              "version": "1775140647",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "rhdh/rhdh-hub-rhel9",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-01-21T23:15:53.240",
  "references": [
    {
      "url": "https://github.com/backstage/backstage/commit/c641c147ab371a9a8a2f5f67fdb7cb9c97ef345d",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/backstage/backstage/security/advisories/GHSA-rq6q-wr2q-7pgp",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:6174",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:6802",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://access.redhat.com/security/cve/CVE-2026-24046",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431878",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24046.json",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        },
        {
          "lang": "en",
          "value": "CWE-59"
        }
      ]
    },
    {
      "type": "Secondary",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "description": [
        {
          "lang": "en",
          "value": "CWE-59"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Backstage is an open framework for building developer portals. Multiple Scaffolder actions and archive extraction utilities were vulnerable to symlink-based path traversal attacks. An attacker with access to create and execute Scaffolder templates could exploit symlinks to read arbitrary files via the `debug:log` action by creating a symlink pointing to sensitive files (e.g., `/etc/passwd`, configuration files, secrets); delete arbitrary files via the `fs:delete` action by creating symlinks pointing outside the workspace, and write files outside the workspace via archive extraction (tar/zip) containing malicious symlinks. This affects any Backstage deployment where users can create or execute Scaffolder templates. This vulnerability is fixed in `@backstage/backend-defaults` versions 0.12.2, 0.13.2, 0.14.1, and 0.15.0; `@backstage/plugin-scaffolder-backend` versions 2.2.2, 3.0.2, and 3.1.1; and `@backstage/plugin-scaffolder-node` versions 0.11.2 and 0.12.3. Users should upgrade to these versions or later. Some workarounds are available. Follow the recommendation in the Backstage Threat Model to limit access to creating and updating templates, restrict who can create and execute Scaffolder templates using the permissions framework, audit existing templates for symlink usage, and/or run Backstage in a containerized environment with limited filesystem access."
    },
    {
      "lang": "es",
      "value": "Backstage es un framework abierto para construir portales de desarrolladores. Múltiples acciones de Scaffolder y utilidades de extracción de archivos eran vulnerables a ataques de salto de ruta basados en symlinks. Un atacante con acceso para crear y ejecutar plantillas de Scaffolder podría explotar symlinks para leer archivos arbitrarios a través de la acción debug:log creando un symlink que apunte a archivos sensibles (p. ej., /etc /passwd, archivos de configuración, secretos); eliminar archivos arbitrarios a través de la acción fs:delete creando symlinks que apunten fuera del espacio de trabajo, y escribir archivos fuera del espacio de trabajo a través de la extracción de archivos (tar/zip) que contengan symlinks maliciosos. Esto afecta a cualquier implementación de Backstage donde los usuarios puedan crear o ejecutar plantillas de Scaffolder. Esta vulnerabilidad está corregida en las versiones 0.12.2, 0.13.2, 0.14.1 y 0.15.0 de @backstage/backend-defaults; las versiones 2.2.2, 3.0.2 y 3.1.1 de @backstage/plugin-scaffolder-backend; y las versiones 0.11.2 y 0.12.3 de @backstage/plugin-scaffolder-node. Los usuarios deben actualizar a estas versiones o posteriores. Hay algunas soluciones alternativas disponibles. Siga la recomendación en el Modelo de Amenazas de Backstage para limitar el acceso a la creación y actualización de plantillas, restringir quién puede crear y ejecutar plantillas de Scaffolder utilizando el framework de permisos, auditar las plantillas existentes en busca de uso de symlinks, y/o ejecutar Backstage en un entorno en contenedores con acceso limitado al sistema de archivos."
    }
  ],
  "lastModified": "2026-07-15T02:18:47.130",
  "sourceIdentifier": "security-advisories@github.com"
}