EUVD-2026-94058
GHSA-xvgh-hmx8-9xxf
Severity by source
AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Network-reachable API but requires a Scaffolder-task permission (PR:L) and winning a retry race (AC:H); scope changes and full C/I/A apply when backend files are writable.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
5DescriptionCVE.org
Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by improper task state validation in scaffolder backend. An authenticated user with permission to create and access Scaffolder tasks may, under specific timing and deployment conditions, affect files accessible to the Backstage backend. If backend application files are writable, the confidentiality, integrity, and availability of the backend may be compromised. This issue is fixed in versions 3.3.1, 3.4.1, 4.0.3 and 4.1.0.
AnalysisAI
Improper task-state validation in the @backstage/plugin-scaffolder-backend plugin (Backstage versions prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0) allows an authenticated user who holds permission to create and access Scaffolder tasks to race the task-retry path and, under specific timing and deployment conditions, influence files reachable by the Backstage backend process. Where the backend's application files are writable by the service - a non-default configuration - this can compromise the confidentiality, integrity and availability of the backend, which is why the advisory carries a high 8.5 CVSS score with scope change; no public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV) for this issue. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated account holding permission to create AND access Scaffolder tasks (PR:L) - not anonymous access. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuinely serious flaw but one whose real-world exploitability is gated by several conditions, so it sits below its 8.5 CVSS headline for most deployments. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released patch by upgrading @backstage/plugin-scaffolder-backend to 3.3.1, 3.4.1, 4.0.3 or 4.1.0 (or move to the corresponding Backstage releases v1.49.6, v1.50.5 or v1.54.6), which restrict task retries to terminal states and serialize concurrent retries; the fixes are visible in the referenced commits (0d24f1b8701f3dde6cd597f81997c1ea873a43ae, 56be299dd3ef6706e13e76ea2f8a9b0dd0b6413d, 9e86c95a1a3ddfd54db03731cd8678aa63495175) and the advisory is at https://github.com/backstage/backstage/security/advisories/GHSA-xvgh-hmx8-9xxf. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Backstage deployments running affected versions (prior to 3.3.1, 3.4.1, 4.0.3, and 4.1.0) and verify whether the Backstage backend process has write access to its own application files; if so, remove write permissions immediately, restrict Scaffolder task creation and retry permissions to only trusted users, and review logs for unusual task retry patterns. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Backstage is an open platform for building developer portals. Rated critical severity (CVSS 9.9), this vulnerability is
Authenticated Backstage users can retrieve the internal execution data of other users' Scaffolder tasks - notably the Se
Authenticated users who can register or modify a TechDocs documentation source can achieve code execution inside the Bac
Arbitrary Python code execution in Backstage's @backstage/plugin-techdocs-node (versions < 1.13.11 and = 1.14.0) lets a
Authenticated remote code execution in the @backstage/plugin-techdocs-node package shipped with the Backstage developer
Path traversal in the Backstage Scaffolder Bitbucket pull-request publish actions allows an authenticated user who can e
Improper input validation in the @backstage/plugin-scaffolder-backend-module-sentry scaffolder actions (Backstage 0.3.0
@backstage/plugin-scaffolder-backend is the backend for the default Backstage software templates. Rated high severity (C
Improper authentication in the Backstage @backstage/plugin-auth-backend-module-oidc-provider package prior to 0.4.20 let
Server-side request forgery in the Backstage @backstage/plugin-techdocs-node package (0.11.12 through 1.14.6, and 1.15.0
Improper URL validation in the @backstage/plugin-catalog-backend package of Backstage prior to 3.5.1, 3.6.2, 3.7.2, 3.8.
Improper validation of MkDocs Markdown extension configuration in Backstage's TechDocs Node package (@backstage/plugin-t
Same weakness CWE-59 – Improper Link Resolution Before File Access
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today