Backstage - CraftedSignal Threat Feed

Improper Authentication Vulnerability in Backstage OIDC Provider

hello@craftedsignal.io — Wed, 07 Oct 2026 22:55:19 +0000

Backstage's @backstage/plugin-auth-backend-module-oidc-provider is affected by an improper authentication vulnerability, tracked as CVE-2026-106488. The flaw exists in the email-based identity resolution process when configured with OIDC providers that do not enforce email verification. An attacker who is authenticated via a malicious or misconfigured OIDC provider can supply an unverified email address that matches an existing user in the Backstage catalog. The application incorrectly maps the attacker's session to the identity of the victim user, allowing for full impersonation of that user's identity and associated permissions within the Backstage environment. This vulnerability affects versions prior to 0.4.20. Defenders should note that this vulnerability does not represent a code injection or direct system compromise, but rather a logic flaw in how identity claims are validated during the OIDC handshake.

Impact

Successful exploitation allows for unauthorized access to catalog entities and sensitive resources managed by Backstage by assuming the identity of another user. This can lead to privilege escalation if the spoofed user account holds administrative roles or high-level access to internal developer portal documentation, service metadata, or infrastructure configurations. No specific victim counts have been reported, but organizations utilizing email-based OIDC identity resolution are at risk if their provider allows unverified addresses.

Recommendation

Upgrade the @backstage/plugin-auth-backend-module-oidc-provider package to version 0.4.20 or later to include the patch for CVE-2026-106488.
Review OIDC provider configurations and disable email-based identity resolution if email verification cannot be strictly enforced at the provider level.
Monitor authentication logs for unexpected account mappings or user sessions originating from non-standard or untrusted OIDC provider issuers.

Path Traversal Vulnerability in Backstage Bitbucket Scaffolder Modules

hello@craftedsignal.io — Wed, 07 Oct 2026 22:54:58 +0000

The Backstage Scaffolder backend modules for Bitbucket Cloud and Bitbucket Server contain an improper filesystem validation vulnerability, tracked as CVE-2026-106486. This flaw exists within the scaffolder actions responsible for interacting with Bitbucket repositories. An authenticated user who has the privileges to execute templates and the ability to influence the targeted Bitbucket repository parameter can supply malicious input to traverse the filesystem on the backend host. By manipulating these inputs, an attacker may escape the expected working directory, potentially reading sensitive configuration files, modifying application code, or deleting arbitrary files. This vulnerability poses a significant risk to backend integrity and confidentiality, particularly in environments where untrusted users have template creation or execution access.

Impact

Successful exploitation allows an authenticated attacker to perform unauthorized file operations on the host running the Backstage backend. This can result in the compromise of backend confidentiality (sensitive file exfiltration), integrity (malicious code injection), or availability (system file deletion). The scope of impact is limited by the permissions of the process running the Backstage backend service.

Recommendation

Upgrade @backstage/plugin-scaffolder-backend-module-bitbucket-cloud to version 0.3.10 or later.
Upgrade @backstage/plugin-scaffolder-backend-module-bitbucket-server to version 0.2.25 or later.
Apply administrative restrictions on Scaffolder template execution, limiting them to trusted users only.
Audit existing Scaffolder templates to identify and restrict actions that accept user-controlled target repository inputs until patching is complete.

Sensitive Information Exposure in Backstage Scaffolder Plugin

hello@craftedsignal.io — Wed, 07 Oct 2026 22:47:15 +0000

The Backstage Scaffolder plugin (specifically @backstage/plugin-scaffolder-backend) contains a vulnerability identified as CVE-2026-106501, which allows for unauthorized access to sensitive internal execution data. An authenticated user within the Backstage environment can perform read operations on Scaffolder tasks created by other users. If these tasks contain sensitive execution metadata, such as hardcoded credentials or API keys used for external service integration, this information is disclosed. The exposure of these credentials can lead to unauthorized access, modifications, or data exfiltration within the downstream external services integrated into the Backstage workflow. This vulnerability affects multiple versions of the plugin prior to 4.1.0, requiring either an immediate upgrade or the implementation of specific task-read access controls to mitigate unauthorized access to sensitive workflows.

Impact

The vulnerability poses a critical risk to organizations relying on Backstage for service orchestration and workflow automation. If successfully exploited, attackers or malicious insiders can obtain privileged credentials that permit unauthorized interaction with integrated third-party systems. This can result in significant data breaches or unauthorized system state changes across the organization's cloud and development infrastructure.

Recommendation

Upgrade @backstage/plugin-scaffolder-backend to version 4.1.0 or later immediately to patch CVE-2026-106501.
If an upgrade is not immediately possible, modify the Scaffolder configuration to apply the isTaskOwner condition to scaffolder.task.read, ensuring that users are restricted to viewing only their own tasks.
Audit active Scaffolder workflows and their integrated services for any potentially compromised credentials that may have been exposed through unauthorized task access.