Backstage plugin-scaffolder-backend: Improper task state validation

Summary

The Scaffolder backend plugin of Backstage, a framework for developer portals, contains an improper task state validation issue with a race condition (CWE-362) and link following (CWE-59). An authenticated user who may create and access Scaffolder tasks can, under specific timing and deployment conditions, affect files that the Backstage backend can access. If backend application files are writable, the confidentiality, integrity and availability of the backend may be compromised. The CVSS 3.1 base score is 8.5 (High), with high attack complexity and low privileges required.

Affected

• @backstage/plugin-scaffolder-backend: < 3.3.1; >= 3.4.0 and < 3.4.1; >= 4.0.0 and < 4.0.3; >= 4.0.4 and < 4.1.0
• Backstage core (backstage/backstage): < 1.49.6; >= 1.50.0-next.0 and < 1.50.5; >= 1.51.0-next.0 and < 1.54.6

Fixed in

• @backstage/plugin-scaffolder-backend: 3.3.1, 3.4.1, 4.0.3, 4.1.0
• Backstage core: 1.49.6, 1.50.5, 1.54.6
• Note: The GHSA advisory names only 4.1.0 as patched version. Check the release notes before patching.

Workaround

• Restrict Scaffolder task creation and task-read permissions to trusted users through the permission policy.
• Limit who can register or modify templates and which Scaffolder actions may execute.
• Run backend application files read-only, outside a dedicated, least-privilege Scaffolder working directory.

Exploitation

• CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
• No evidence of known exploitation in the sources reviewed. Not marked as known exploited in the sources reviewed; the CISA KEV catalogue was not checked directly.
• No public proof of concept found in the research. This does not prove that none exists.

Our recommendation

• Update @backstage/plugin-scaffolder-backend to 4.1.0 or the Backstage core release that includes the fix, in the next maintenance window.
• Until patched, restrict Scaffolder task rights to trusted users and review template and action permissions.
• Check whether Backstage instances are reachable from the internet and whether backend application files are writable; make them read-only where possible.
• Review related Scaffolder advisories published at the same time (for example CVE-2026-106501 and CVE-2026-106506) together with this update.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• GitHub Security Advisory GHSA-xvgh-hmx8-9xxf github.com
• Backstage release v1.49.6 github.com
• Backstage release v1.50.5 github.com
• Backstage release v1.54.6 github.com
• Fix commit 0d24f1b8 (Backstage) github.com
• OSV entry GHSA-xvgh-hmx8-9xxf osv.dev

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 11:16.