CVE-2026-106461

Executive Summary

CVE-2026-106461 is an incorrect authorization vulnerability (CWE-863) in the @backstage/plugin-scaffolder-backend package affecting deployments prior to version 4.1.0. An authenticated internal user can view metadata for scaffolder tasks that fall outside the visibility scope defined by the deployment's permission policy, resulting in a limited confidentiality impact. There is no integrity or availability impact, no exposure of stored task secrets, and no public proof-of-concept or active exploitation observed at the time of writing.

Technical Analysis

Backstage is an open framework for building developer portals, and the scaffolder backend plugin manages software template execution as "tasks." Task metadata is normally subject to authorization checks that determine which users may enumerate or inspect tasks based on the deployment's configured permission policy. CVE-2026-106461 describes an incorrect authorization condition in the scaffolder task listing functionality: prior to version 4.1.0, the authorization logic governing which tasks are listed for a given caller does not correctly enforce the deployment's intended visibility boundary.

The practical consequence is that an authenticated internal user — holding a valid account and an authenticated session — may be able to view metadata for scaffolder tasks that the permission policy intended to keep outside that user's visibility. This is a horizontal and/or vertical information-disclosure issue rooted in improper access control rather than a memory-safety, injection, or code-execution defect.

Key constraints from the available description bound the severity of the flaw. First, the affected response does not include stored task secrets, so exfiltrated metadata does not directly yield credentials or other sensitive values persisted with tasks. Second, no integrity or availability impact was identified — an attacker cannot use this flaw to modify task state or disrupt task execution based on the described behavior. The exposure is therefore limited to the contents of task metadata that the permission policy was meant to restrict.

The vulnerability is network-reachable (AV:N), requires low privileges (PR:L) in the form of a valid authenticated account, needs no user interaction (UI:N), and affects only the vulnerable component itself (S:U). The CVSS v3.1 base score is 4.3 (Medium), with a Low confidentiality impact (C:L) and no integrity or availability impact (I:N/A:N). Because the description does not name specific routes, handler functions, query parameters, or data structures involved in the incorrect authorization check, the precise code-level defect cannot be reconstructed from the available intelligence; the analysis below remains at the vulnerability-class level rather than asserting unverified implementation details.

The root cause class — CWE-863 (Incorrect Authorization) — commonly arises when a listing or enumeration endpoint applies a filter that is narrower, broader, or otherwise divergent from the authorization model enforced on individual resource access. In this instance, the listing behavior evidently diverges from the visibility intended by the deployment's permission policy, allowing metadata about tasks outside the caller's scope to be returned.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template exists for CVE-2026-106461; the attack chain below is inferred from the vulnerability class (CWE-863) and the NVD description, and does not rely on any fabricated function names, endpoints, or parameters.

1. Reconnaissance / target identification. An adversary with access to a Backstage developer portal — for example an internal employee, contractor, or any party holding a valid low-privilege account — identifies a deployment running an affected version of @backstage/plugin-scaffolder-backend (prior to 4.1.0). The attacker confirms they can authenticate to the portal, which is the only prerequisite given PR:L and UI:N in the CVSS vector. Because the flaw requires network access and an authenticated session, no internet-facing unauthenticated exposure is implied by the data.

2. Triggering the flaw. Using their authenticated session, the attacker interacts with the scaffolder task listing functionality. The incorrect authorization condition means the listing does not correctly confine results to the visibility scope defined by the deployment's permission policy, so the response can include metadata for tasks outside the attacker's intended view. The attacker need not exploit a memory-corruption primitive, inject input, or manipulate a parameter value; the flaw is a direct consequence of the authorization decision applied to the listing.

3. Payload / execution method. At the vulnerability-class level, the "payload" is simply an authenticated request to the task listing surface of the scaffolder backend. No weaponized input is required — the attacker leverages the existing authorization gap so that tasks they should not see are enumerated. Per the description, stored task secrets are not included in the affected response, so this step yields metadata, not secrets.

4. Post-exploitation impact. The attacker gains visibility into scaffolder task metadata outside their permitted scope. This is an information-disclosure outcome with a Low confidentiality impact. It may be used for further reconnaissance — for example to map internal software templates, task activity, ownership, or organizational workflow patterns — and could support lateral targeting or social engineering. No integrity or availability compromise (e.g., task modification or disruption) is possible via this flaw, and no stored task secrets are disclosed, which materially limits the follow-on blast radius.

Impact Assessment

The business impact of CVE-2026-106461 is bounded and primarily informational. Successful exploitation discloses scaffolder task metadata to an authenticated user who should not have visibility into those tasks, as measured by the deployment's own permission policy. This can leak details about software templates, internal task activity, and workflow structure that an organization intended to keep scoped to specific teams or roles. Such metadata can be valuable reconnaissance for an insider or a low-privilege compromised account seeking to understand internal systems, but it does not directly expose credentials (stored task secrets are excluded from the affected response), and it does not permit modification or denial of service.

The CVSS v3.1 vector — AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N — yields a base score of 4.3. The low attack complexity and absence of user interaction mean the flaw is straightforward to trigger by anyone already authenticated; the mitigating factors are the privilege requirement (a valid account is needed), the limited confidentiality-only impact, and the unchanged scope. Blast radius is confined to deployments running @backstage/plugin-scaffolder-backend prior to 4.1.0 whose permission policies rely on the affected listing behavior to enforce visibility. Organizations without Backstage, or with the plugin absent, are not affected. There is no evidence of CISA KEV listing and no active exploitation observed, so risk is best characterized as an insider-relevant or multi-tenant-boundary concern rather than an internet-scale emergency.

Detection Guidance

Sigma Rule

title: Backstage Scaffolder Task Metadata Enumeration by Low-Privilege User
id: 3f9c2b41-8a7e-4d15-9c6b-cve2026106461
status: experimental
description: Detects authenticated requests to the Backstage scaffolder task listing surface from accounts that may be attempting to enumerate tasks outside their permission policy scope (CVE-2026-106461).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-106461
author: SOC Detection Engineering
date: 2026-01-01
tags:
  - attack.discovery
  - attack.t1078
logsource:
  category: web
  product: backstage
detection:
  selection_method:
    http.method: GET
  selection_path:
    url.path|contains:
      - '/scaffolder/tasks'
      - '/api/scaffolder/tasks'
  selection_status:
    http.response.status_code: 200
  condition: selection_method and selection_path and selection_status
fields:
  - c-ip
  - cs-username
  - url.path
  - http.response.status_code
falsepositives:
  - Legitimate users listing their own scaffolder tasks.
  - Automated tooling and dashboards that poll task status.
level: low

YARA Rule

rule CVE_2026_106461_Backstage_Scaffolder_Task_Enum
{
    meta:
        description = "Detects requests or logs referencing Backstage scaffolder task listing paths associated with CVE-2026-106461 (incorrect authorization)"
        author = "SOC Detection Engineering"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-106461"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $p1 = "/scaffolder/tasks" ascii wide nocase
        $p2 = "/api/scaffolder/tasks" ascii wide nocase
        $p3 = "scaffolder-backend" ascii wide nocase
        $p4 = "@backstage/plugin-scaffolder-backend" ascii wide nocase

    condition:
        (uint16(0) == 0x4854 or true) and
        (($p1 or $p2) and ($p3 or $p4))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-106461 Backstage Scaffolder Task Listing Enumeration Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/scaffolder/tasks"; nocase; http.uri; content:"/api/scaffolder/tasks"; nocase; sid:2026106461; rev:1; metadata:created_at 2026_01_01, cve CVE-2026-106461; classtype:attempted-recon; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-106461;)

Elastic Detection

sequence by user.name with maxspan=5m
  [ network where network.protocol == "http" and http.request.method == "GET"
      and url.path : ("/scaffolder/tasks" or "/api/scaffolder/tasks")
      and http.response.status_code == 200 ]
  [ network where network.protocol == "http" and http.request.method == "GET"
      and url.path : ("/scaffolder/tasks" or "/api/scaffolder/tasks")
      and http.response.status_code == 200 ]

Splunk SPL Query

index=web OR index=proxy
| eval path=coalesce(url_path, uri_path, url)
| where match(path, "(?i)/(api/)?scaffolder/tasks")
| where upper(http_method)=="GET" AND status=200
| stats count min(_time) as first_seen max(_time) as last_seen values(src_ip) as src_ips by user, path
| where count >= 3
| sort - count
| table user path count first_seen last_seen src_ips

Wazuh OSSEC Rule

<group name="backstage,cve-2026-106461,">
  <rule id="106461" level="6">
    <decoded_as>json</decoded_as>
    <field name="url.path">/scaffolder/tasks</field>
    <field name="http.request.method">GET</field>
    <description>CVE-2026-106461: Backstage scaffolder task listing accessed - possible incorrect authorization enumeration.</description>
    <mitre>
      <id>T1078</id>
    </mitre>
    <group>attempted_recon,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations. Because no verified patch artifacts are tracked in this dataset, treat the deployment as exposed until the fixed release is validated in your environment. Restrict access to the Backstage portal to trusted internal networks and limit the population of accounts that can authenticate, since exploitation requires an authenticated session. Tighten the deployment's permission policy so that task visibility is enforced on individual task access in addition to listing, and monitor for anomalous enumeration of the task listing surface using the detection content above. Where feasible, temporarily reduce the set of plugins and templates exposing scaffolder task metadata to the minimum required by operational users.

2. Patch / upgrade steps. The NVD description states the issue is fixed in version 4.1.0 of the @backstage/plugin-scaffolder-backend package. Upgrade the package to 4.1.0 or later and rebuild/redeploy the Backstage backend. Validate the upgrade in a staging environment, confirm the scaffolder backend functions correctly after the version bump, and re-verify that task visibility now matches the intended permission policy. Note: no vendor advisory URL or patch source was recovered in this dataset, so confirm the fixed version against the upstream Backstage release notes before relying on it.

3. Long-term hardening. Adopt a least-privilege permission model for the scaffolder plugin so that listing endpoints apply the same authorization logic as per-resource access. Enforce centralized, testable authorization checks (avoid divergent logic between list and get operations that can produce CWE-863 conditions). Maintain continuous dependency scanning to detect affected versions of Backstage packages, and track upstream Backstage security advisories for this and related plugins. Apply audit logging on all task listing and retrieval endpoints so enumeration attempts are attributable to an authenticated identity.

References

• NVD — CVE-2026-106461: https://nvd.nist.gov/vuln/detail/CVE-2026-106461
• Backstage project (upstream framework and package release notes): https://backstage.io
• MITRE CWE-863 — Incorrect Authorization: https://cwe.mitre.org/data/definitions/863.html
• CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-106461 is NOT listed)
• FIRST EPSS: not yet scored at the time of writing; no exploit-in-the-wild evidence or known threat actor campaigns identified in the available data.