backstage plugin-scaffolder-backend-module-github vulnerabilities

Latest backstage plugin-scaffolder-backend-module-github CVEs

Newest publication first

1. CVE-2026-106462 Backstage: Scaffolder credential handling may allow unintended GitHub authentication fallback

   Published 2026-10-06

   Medium·CVSS 6.4 EPSS 0.17%

   Backstage is an open framework for building developer portals. Prior to 1.54.6, scaffolder source-control actions may not consistently enforce intended credential boundaries. An authenticated user could cause an affected action to fall back to broader integration credentials and...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.