CVE-2026-106500: Backstage: Improper task state validation in Scaffolder backend
An authenticated user with permission to create and access Scaffolder tasks may, under specific timing and deployment conditions, affect files accessible to the Backstage backend. If backend application files are writable, the confidentiality, integrity, and availability of the backend may be compromised.
References
- github.com/advisories/GHSA-xvgh-hmx8-9xxf
- github.com/backstage/backstage/commit/0d24f1b8701f3dde6cd597f81997c1ea873a43ae
- github.com/backstage/backstage/commit/56be299dd3ef6706e13e76ea2f8a9b0dd0b6413d
- github.com/backstage/backstage/commit/9e86c95a1a3ddfd54db03731cd8678aa63495175
- github.com/backstage/backstage/releases/tag/v1.49.6
- github.com/backstage/backstage/releases/tag/v1.50.5
- github.com/backstage/backstage/releases/tag/v1.54.6
- github.com/backstage/backstage/security/advisories/GHSA-xvgh-hmx8-9xxf
- nvd.nist.gov/vuln/detail/CVE-2026-106500
Code Behaviors & Features
Detect and mitigate CVE-2026-106500 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →