CVE-2026-106461: Backstage: Incorrect authorization in scaffolder task listing

October 7, 2026

An authenticated internal user may be able to view metadata for scaffolder tasks outside the visibility intended by a deployment’s permission policy. Stored task secrets are not included in the affected response, and no integrity or availability impact was identified.

References

github.com/advisories/GHSA-7hfw-grcm-cqm6
github.com/backstage/backstage/commit/0253c50673f2832b0b1e9f73348186434e7bd09e
github.com/backstage/backstage/releases/tag/v1.54.6
github.com/backstage/backstage/security/advisories/GHSA-7hfw-grcm-cqm6
nvd.nist.gov/vuln/detail/CVE-2026-106461

Code Behaviors & Features

Detect and mitigate CVE-2026-106461 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →