CVE-2026-106462

Backstage is an open framework for building developer portals. Prior to 1.54.6, scaffolder source-control actions may not consistently enforce intended credential boundaries. An authenticated user could cause an affected action to fall back to broader integration credentials and perform operation...

CVE-2026-106459

Backstage is an open framework for building developer portals. From 0.3.0 until 0.3.8, the @backstage/plugin-scaffolder-backend-module-sentry package is affected by improper input validation in sentry scaffolder actions. An authenticated internal user who can execute the affected actions may caus...

CVE-2026-106456

Backstage is an open framework for building developer portals. From 0.5.0 until 0.6.18, the @backstage/plugin-proxy-backend package is affected by inconsistent credential enforcement for overlapping proxy routes. An operator can configure overlapping proxy paths with different credential...

CVE-2026-106492 Backstage: Improper preservation of access restrictions during service credential delegation

Backstage is an open framework for building developer portals. Prior to 0.16.1 and 0.17.8, the @backstage/backend-defaults package is affected by improper preservation of access restrictions during service credential delegation. An external service credential configured with access restrictions...

CVE-2026-106492

The Backstage framework is vulnerable in the @backstage/backend-defaults package prior to versions 0.16.1 and 0.17.8 . The root cause is the improper preservation of access restrictions during service credential delegation. Specifically, an external service credential with restrictions (such as r...

CVE-2026-106492 Backstage: Improper preservation of access restrictions during service credential delegation

Backstage is an open framework for building developer portals. Prior to 0.16.1 and 0.17.8, the @backstage/backend-defaults package is affected by improper preservation of access restrictions during service credential delegation. An external service credential configured with access restrictions...

CVE-2026-106492 Backstage: Improper preservation of access restrictions during service credential delegation

Backstage is an open framework for building developer portals. Prior to 0.16.1 and 0.17.8, the @backstage/backend-defaults package is affected by improper preservation of access restrictions during service credential delegation. An external service credential configured with access restrictions...

CVE-2026-106462

The Backstage open framework for building developer portals is vulnerable in versions prior to 1.54.6 . The scaffolder source-control actions may fail to consistently enforce intended credential boundaries, potentially allowing an authenticated user to trigger an action that falls back to broader...

CVE-2026-106462

Backstage is an open framework for building developer portals. Prior to 1.54.6, scaffolder source-control actions may not consistently enforce intended credential boundaries. An authenticated user could cause an affected action to fall back to broader integration credentials and perform operation...

CVE-2026-106462 Backstage: Scaffolder credential handling may allow unintended GitHub authentication fallback

Backstage is an open framework for building developer portals. Prior to 1.54.6, scaffolder source-control actions may not consistently enforce intended credential boundaries. An authenticated user could cause an affected action to fall back to broader integration credentials and perform operation...

CVE-2026-106462 Backstage: Scaffolder credential handling may allow unintended GitHub authentication fallback

Backstage is an open framework for building developer portals. Prior to 1.54.6, scaffolder source-control actions may not consistently enforce intended credential boundaries. An authenticated user could cause an affected action to fall back to broader integration credentials and perform operation...

CVE-2026-106462 Backstage: Scaffolder credential handling may allow unintended GitHub authentication fallback

Backstage is an open framework for building developer portals. Prior to 1.54.6, scaffolder source-control actions may not consistently enforce intended credential boundaries. An authenticated user could cause an affected action to fall back to broader integration credentials and perform operation...

CVE-2026-106553

The OpenSSH sshd daemon versions before 10.6 are vulnerable to a flaw where credentials can incorrectly persist following a failed GSSAPIAuthentication attempt. This issue is associated with CWE-669 (Incorrect Resource Transfer Between Spheres). While the vulnerability's severity is rated as HIGH...

CVE-2026-106553

In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt...

CVE-2026-106553

In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt...

CVE-2026-106553

In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt...

CVE-2026-106459 Backstage: Improper input validation in Sentry scaffolder actions

Backstage is an open framework for building developer portals. From 0.3.0 until 0.3.8, the @backstage/plugin-scaffolder-backend-module-sentry package is affected by improper input validation in sentry scaffolder actions. An authenticated internal user who can execute the affected actions may caus...

CVE-2026-106459

The Backstage framework is affected by an improper input validation vulnerability in the @backstage/plugin-scaffolder-backend-module-sentry package, specifically within sentry scaffolder actions . Versions 0.3.0 through 0.3.8 are impacted. An authenticated internal user capable of executing these...

CVE-2026-106456 Backstage: Inconsistent credential enforcement for overlapping proxy routes

Backstage is an open framework for building developer portals. From 0.5.0 until 0.6.18, the @backstage/plugin-proxy-backend package is affected by inconsistent credential enforcement for overlapping proxy routes. An operator can configure overlapping proxy paths with different credential...

CVE-2026-106456

The Backstage open framework for developer portals is affected by a vulnerability in the @backstage/plugin-proxy-backend package (versions 0.5.0 through 0.6.18 ). The root cause is inconsistent credential enforcement for overlapping proxy routes; if a parent path allows unauthenticated access whi...