CVE-2026-106500
8.5 HIGHpublic exploit availablePublished 2026-10-06 · Updated 2026-10-07
AI risk analysis
- Summary
- The Backstage scaffolder backend has a flaw in task state validation that allows authenticated users to potentially access and modify backend application files under specific conditions. This could lead to compromise of confidentiality, integrity, and availability of the backend system.
- Exploitability
- Exploitation requires an authenticated user with scaffolder task permissions and specific deployment timing conditions, making it moderately difficult but not highly complex to achieve.
- Blast radius
- If exploited, this vulnerability could allow attackers to modify backend application files, potentially leading to complete backend compromise including code execution and data breaches.
- Detection
- No reliable host or network indicator is derivable from the published description.
- Prioritized remediation
- Upgrade to Backstage versions 3.3.1, 3.4.1, 4.0.3, or 4.1.0 where this vulnerability is fixed.
Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.
NVD description
Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by improper task state validation in scaffolder backend. An authenticated user with permission to create and access Scaffolder tasks may, under specific timing and deployment conditions, affect files accessible to the Backstage backend. If backend application files are writable, the confidentiality, integrity, and availability of the backend may be compromised. This issue is fixed in versions 3.3.1, 3.4.1, 4.0.3 and 4.1.0.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-59, CWE-362
Public exploit & PoC references
- https://github.com/backstage/backstage/commit/0d24f1b8701f3dde6cd597f81997c1ea873a43ae
- https://github.com/backstage/backstage/commit/56be299dd3ef6706e13e76ea2f8a9b0dd0b6413d
- https://github.com/backstage/backstage/commit/9e86c95a1a3ddfd54db03731cd8678aa63495175
- https://github.com/backstage/backstage/releases/tag/v1.49.6
- https://github.com/backstage/backstage/releases/tag/v1.50.5
- https://github.com/backstage/backstage/releases/tag/v1.54.6
- https://github.com/backstage/backstage/security/advisories/GHSA-xvgh-hmx8-9xxf
All references
- https://github.com/backstage/backstage/commit/0d24f1b8701f3dde6cd597f81997c1ea873a43ae
- https://github.com/backstage/backstage/commit/56be299dd3ef6706e13e76ea2f8a9b0dd0b6413d
- https://github.com/backstage/backstage/commit/9e86c95a1a3ddfd54db03731cd8678aa63495175
- https://github.com/backstage/backstage/releases/tag/v1.49.6
- https://github.com/backstage/backstage/releases/tag/v1.50.5
- https://github.com/backstage/backstage/releases/tag/v1.54.6
- https://github.com/backstage/backstage/security/advisories/GHSA-xvgh-hmx8-9xxf
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- HIGHCVE-2026-102113PoC
- HIGHCVE-2026-102112PoC
- CRITICALCVE-2026-92262PoC
- CRITICALCVE-2026-101894PoC
- HIGHCVE-2026-102118PoC
- HIGHCVE-2026-106486PoC
- HIGHCVE-2026-107707
- HIGHCVE-2026-107810PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.