CVE-2026-106503: Backstage Scaffolder Auth Bypass Vulnerability

CVE-2026-106503 Overview

CVE-2026-106503 is an authorization bypass vulnerability in the @backstage/plugin-scaffolder-backend package of Backstage, an open framework for building developer portals. Authenticated users with access to affected Scaffolder templates can bypass configured action restrictions. Depending on the integration credentials in use, successful exploitation can grant unauthorized access to repositories and related source-control resources. The flaw is classified under CWE-178: Improper Handling of Case Sensitivity and tracked in GitHub Security Advisory GHSA-hmp2-4m7g-22cv. Fixes are available in @backstage/plugin-scaffolder-backend versions 3.3.1, 3.4.1, 4.0.3, and 4.1.0.

Critical Impact

Authenticated users can bypass Scaffolder action authorization rules and leverage integration credentials to reach source-control resources they should not access.

Affected Products

• Backstage @backstage/plugin-scaffolder-backend prior to 3.3.1
• Backstage @backstage/plugin-scaffolder-backend prior to 3.4.1
• Backstage @backstage/plugin-scaffolder-backend prior to 4.0.3 and 4.1.0

Discovery Timeline

• 2026-10-06 - CVE-2026-106503 published to NVD
• 2026-10-07 - Last updated in NVD database

Technical Details for CVE-2026-106503

Vulnerability Analysis

The Backstage Scaffolder enforces action restrictions through permission rules evaluated against template inputs. The vulnerable code paths in plugins/scaffolder-backend/src/service/rules.ts and plugins/scaffolder-backend/src/scaffolder/tasks/NunjucksWorkflowRunner.ts resolved input paths using lodash get, which does not normalize path segments consistently with how templates reference inputs. An authenticated template user can craft input identifiers that resolve to the same underlying value but evade the configured rule match. The result is an authorization check that approves an action invocation the policy intended to deny.

Root Cause

The root cause is inconsistent input path handling between policy evaluation and action execution. Policy rules were matched using a representation of the input path that differed from the representation ultimately used at runtime. Mapping to CWE-178, improper handling of path case or segment form allowed semantically equivalent references to evade string-based rule comparisons. The patch introduces toPath from lodash and zod/v3 validation so that both the rule engine and the workflow runner normalize paths identically before comparison.

Attack Vector

Exploitation requires network access to the Backstage instance and an authenticated account with permission to execute at least one Scaffolder template. The attacker submits a template execution with input values crafted to resolve past the authorization rule but still trigger a restricted action, such as a repository create or publish step. Because Scaffolder actions execute with the Backstage integration credentials for GitHub, GitLab, Bitbucket, or similar providers, the attacker inherits that credential scope against source-control resources.

// Patch: plugins/scaffolder-backend/src/service/rules.ts
 import { z } from 'zod/v3';
 import { JsonObject, JsonPrimitive } from '@backstage/types';
-import { get } from 'lodash';
+import { get, toPath } from 'lodash';
 
 export const createTemplatePermissionRule = makeCreatePermissionRule<
   TemplateEntityStepV1beta3 | TemplateParametersV1beta3,

// Patch: plugins/scaffolder-backend/src/scaffolder/tasks/NunjucksWorkflowRunner.ts
 import fs from 'fs-extra';
 import { validate as validateJsonSchema } from 'jsonschema';
+import { toPath } from 'lodash';
 import nunjucks from 'nunjucks';
 import path from 'node:path';
 import * as winston from 'winston';
+import { z } from 'zod/v3';
// Source: https://github.com/backstage/backstage/commit/11c1384c0649b8ab26391c6a4e4f34b80ab0d188

Detection Methods for CVE-2026-106503

Indicators of Compromise

• Scaffolder task logs showing successful execution of actions that should have been blocked by configured permission rules.
• Repository creation, branch push, or pull-request events in GitHub, GitLab, or Bitbucket audit logs attributed to the Backstage integration identity but not tied to an approved template run.
• Template input payloads containing unusual path segment casing, bracket notation, or nested keys that differ from documented template parameters.

Detection Strategies

• Review the Backstage scaffolder task database for tasks whose action list includes operations outside the template's expected scope.
• Correlate Scaffolder task actor identities with downstream SCM write events to detect privileged actions attributed to standard users.
• Alert on any Scaffolder task execution originating from a user account that lacks a corresponding permission-rule evaluation entry.

Monitoring Recommendations

• Forward Backstage backend logs and SCM audit events to a centralized analytics platform for cross-source correlation.
• Monitor the running version of @backstage/plugin-scaffolder-backend across all Backstage deployments and alert on versions below the fixed releases.
• Track outbound API calls made with Backstage integration tokens and baseline normal activity to surface authorization-bypass abuse.

How to Mitigate CVE-2026-106503

Immediate Actions Required

• Upgrade @backstage/plugin-scaffolder-backend to 3.3.1, 3.4.1, 4.0.3, or 4.1.0 depending on the deployed major line.
• Audit all Scaffolder templates and permission rules to confirm no unexpected action was executed since deployment.
• Rotate integration credentials (GitHub Apps, personal access tokens, GitLab tokens) used by Scaffolder actions if abuse is suspected.

Patch Information

Backstage shipped the fix across three parallel maintenance lines. Reference commits 11c1384c, a91ed72d, and e307e4f4 update rules.ts and NunjucksWorkflowRunner.ts to normalize input paths with toPath and validate with zod. Fixed Backstage app bundles are published as v1.49.6, v1.50.5, and v1.54.6.

Workarounds

• Restrict access to Scaffolder templates to a minimal set of trusted users until patches are deployed.
• Reduce the scope of integration credentials used by Scaffolder actions to the minimum repositories and permissions required.
• Disable or remove templates that invoke sensitive publish, repository, or secret-management actions where authorization bypass would be most damaging.

# Upgrade the vulnerable package in a Backstage workspace
yarn workspace backend add @backstage/plugin-scaffolder-backend@^4.1.0

# Verify installed version
yarn why @backstage/plugin-scaffolder-backend