EUVD-2026-93999

Backstage's scaffolder credential handling may allow unintended GitHub authentication fallback...

EUVD-2026-94068

Backstage: Scaffolder action input authorization bypass...

Backstage: Scaffolder action input authorization bypass

Impact An authenticated user with access to affected Scaffolder templates could bypass configured action restrictions. Depending on integration credentials, this could grant unauthorized access to repositories and related source-control resources. Patches Patched in...

GHSA-HMP2-4M7G-22CV Backstage: Scaffolder action input authorization bypass

Impact An authenticated user with access to affected Scaffolder templates could bypass configured action restrictions. Depending on integration credentials, this could grant unauthorized access to repositories and related source-control resources. Patches Patched in...

CVE-2026-106503

A flaw was found in the Backstage plugin-scaffolder-backend component. An authorization bypass allows an authenticated user with access to Scaffolder templates to circumvent configured action restrictions. By manipulating action inputs, an attacker can leverage integration credentials to gain...

CVE-2026-106503

Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by scaffolder action input authorization bypass. An authenticated user with access to affected Scaffolder templates could bypass...

CVE-2026-106503 Backstage: Scaffolder action input authorization bypass

Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by scaffolder action input authorization bypass. An authenticated user with access to affected Scaffolder templates could bypass...

CVE-2026-106462

Backstage is an open framework for building developer portals. Prior to 1.54.6, scaffolder source-control actions may not consistently enforce intended credential boundaries. An authenticated user could cause an affected action to fall back to broader integration credentials and perform operation...

CVE-2026-106462

Backstage is an open framework for building developer portals. Prior to 1.54.6, scaffolder source-control actions may not consistently enforce intended credential boundaries. An authenticated user could cause an affected action to fall back to broader integration credentials and perform operation...

CVE-2026-106462: Unintended Proxy or Intermediary

Backstage is an open framework for building developer portals. Prior to 1.54.6, scaffolder source-control actions may not consistently enforce intended credential boundaries. An authenticated user could cause an affected action to fall back to broader integration credentials and perform operation...

PT-2026-107300

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 3.3.1 Backstage versions prior to 3.4.1 Backstage versions prior to 4.0.3 Backstage versions prior to 4.1.0 Description The @backstage/plugin-scaffolder-backend package contains an authorization bypass regarding...

CVE-2026-106503: Improper Handling of Case Sensitivity

Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by scaffolder action input authorization bypass. An authenticated user with access to affected Scaffolder templates could bypass...

PT-2026-107265

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 1.54.6 Description Scaffolder source-control actions may not consistently enforce intended credential boundaries. This allows an authenticated user to cause an affected action to fall back to broader integration...

PT-2026-96135

Name of the Vulnerable Software and Affected Versions GoCD versions prior to 26.1.0 Description GoCD can return unmasked credentials stored in the userinfo portion of source control material URLs. This occurs through several read-only APIs available to regular authenticated users. While dedicated...

CVE-2026-55870: Exposure of Sensitive Information to an Unauthorized Actor

GoCD is a continuous deliver server. Prior to 26.1.0, GoCD can return unmasked credentials that administrators stored in the userinfo portion of source control material URLs through several read-only APIs available to regular authenticated users. Although GoCD recommends dedicated username and...

EUVD-2026-81288

n8n is a workflow automation platform. In n8n versions before 1.123.76, 2.37.7, and 2.38.2, the source control push endpoint derived the set of files to push from the file paths and status supplied in the client request payload instead of from the server-side status computed for the requesting...

CVE-2026-92588

n8n is a workflow automation platform. In n8n versions before 1.123.76, 2.37.7, and 2.38.2, the source control push endpoint derived the set of files to push from the file paths and status supplied in the client request payload instead of from the server-side status computed for the requesting...

CVE-2026-92588 n8n before 1.123.76 Improper Authorization via Source Control Push

n8n is a workflow automation platform. In n8n versions before 1.123.76, 2.37.7, and 2.38.2, the source control push endpoint derived the set of files to push from the file paths and status supplied in the client request payload instead of from the server-side status computed for the requesting...

CVE-2026-92588

n8n is a workflow automation platform. In versions before 1.123.76 , 2.37.7 , and 2.38.2 , the source control push endpoint derived the set of files to push from client-supplied file paths and status rather than from server-side status computed for the requesting user. An authenticated project-sc...

CVE-2026-92588 n8n before 1.123.76 Improper Authorization via Source Control Push

n8n is a workflow automation platform. In n8n versions before 1.123.76, 2.37.7, and 2.38.2, the source control push endpoint derived the set of files to push from the file paths and status supplied in the client request payload instead of from the server-side status computed for the requesting...