{"schema":"vulnpedia.research/1","cve":"CVE-2026-106503","generated":"2026-10-26T13:52:32.101Z","references":[{"url":"https://github.com/backstage/backstage/security/advisories/GHSA-hmp2-4m7g-22cv","tags":["x_refsource_CONFIRM","Mitigation","Vendor Advisory","WEB","vendor-reference"],"source":"mitre","sourceId":"GitHub_M","modified":"2026-10-06T21:37:33.675Z","origins":[{"source":"mitre","sourceId":"GitHub_M","modified":"2026-10-06T21:37:33.675Z","url":"https://github.com/backstage/backstage/security/advisories/GHSA-hmp2-4m7g-22cv"},{"source":"nvd","sourceId":"CVE-2026-106503","modified":"2026-10-13T14:37:56.910","url":"https://github.com/backstage/backstage/security/advisories/GHSA-hmp2-4m7g-22cv"},{"source":"ghsa","sourceId":"GHSA-hmp2-4m7g-22cv","url":"https://github.com/backstage/backstage/security/advisories/GHSA-hmp2-4m7g-22cv"},{"source":"ghsa","sourceId":"GHSA-hmp2-4m7g-22cv","modified":"2026-10-07T18:15:12.169871159Z","url":"https://github.com/backstage/backstage/security/advisories/GHSA-hmp2-4m7g-22cv"},{"source":"redhat","sourceId":"CVE-2026-106503","modified":"2026-10-21T08:50:29+00:00","url":"https://github.com/backstage/backstage/security/advisories/GHSA-hmp2-4m7g-22cv"}]},{"url":"https://github.com/backstage/backstage/commit/11c1384c0649b8ab26391c6a4e4f34b80ab0d188","tags":["x_refsource_MISC","Patch","WEB","vendor-reference"],"source":"mitre","sourceId":"GitHub_M","modified":"2026-10-06T21:37:33.675Z","origins":[{"source":"mitre","sourceId":"GitHub_M","modified":"2026-10-06T21:37:33.675Z","url":"https://github.com/backstage/backstage/commit/11c1384c0649b8ab26391c6a4e4f34b80ab0d188"},{"source":"nvd","sourceId":"CVE-2026-106503","modified":"2026-10-13T14:37:56.910","url":"https://github.com/backstage/backstage/commit/11c1384c0649b8ab26391c6a4e4f34b80ab0d188"},{"source":"ghsa","sourceId":"GHSA-hmp2-4m7g-22cv","url":"https://github.com/backstage/backstage/commit/11c1384c0649b8ab26391c6a4e4f34b80ab0d188"},{"source":"ghsa","sourceId":"GHSA-hmp2-4m7g-22cv","modified":"2026-10-07T18:15:12.169871159Z","url":"https://github.com/backstage/backstage/commit/11c1384c0649b8ab26391c6a4e4f34b80ab0d188"},{"source":"redhat","sourceId":"CVE-2026-106503","modified":"2026-10-21T08:50:29+00:00","url":"https://github.com/backstage/backstage/commit/11c1384c0649b8ab26391c6a4e4f34b80ab0d188"}]},{"url":"https://github.com/backstage/backstage/commit/a91ed72d540e80b62a73b39bb1563ff5018d52d1","tags":["x_refsource_MISC","Patch","WEB","vendor-reference"],"source":"mitre","sourceId":"GitHub_M","modified":"2026-10-06T21:37:33.675Z","origins":[{"source":"mitre","sourceId":"GitHub_M","modified":"2026-10-06T21:37:33.675Z","url":"https://github.com/backstage/backstage/commit/a91ed72d540e80b62a73b39bb1563ff5018d52d1"},{"source":"nvd","sourceId":"CVE-2026-106503","modified":"2026-10-13T14:37:56.910","url":"https://github.com/backstage/backstage/commit/a91ed72d540e80b62a73b39bb1563ff5018d52d1"},{"source":"ghsa","sourceId":"GHSA-hmp2-4m7g-22cv","url":"https://github.com/backstage/backstage/commit/a91ed72d540e80b62a73b39bb1563ff5018d52d1"},{"source":"ghsa","sourceId":"GHSA-hmp2-4m7g-22cv","modified":"2026-10-07T18:15:12.169871159Z","url":"https://github.com/backstage/backstage/commit/a91ed72d540e80b62a73b39bb1563ff5018d52d1"},{"source":"redhat","sourceId":"CVE-2026-106503","modified":"2026-10-21T08:50:29+00:00","url":"https://github.com/backstage/backstage/commit/a91ed72d540e80b62a73b39bb1563ff5018d52d1"}]},{"url":"https://github.com/backstage/backstage/commit/e307e4f487103d815e484291b3fda778ab9983bf","tags":["x_refsource_MISC","Patch","WEB","vendor-reference"],"source":"mitre","sourceId":"GitHub_M","modified":"2026-10-06T21:37:33.675Z","origins":[{"source":"mitre","sourceId":"GitHub_M","modified":"2026-10-06T21:37:33.675Z","url":"https://github.com/backstage/backstage/commit/e307e4f487103d815e484291b3fda778ab9983bf"},{"source":"nvd","sourceId":"CVE-2026-106503","modified":"2026-10-13T14:37:56.910","url":"https://github.com/backstage/backstage/commit/e307e4f487103d815e484291b3fda778ab9983bf"},{"source":"ghsa","sourceId":"GHSA-hmp2-4m7g-22cv","url":"https://github.com/backstage/backstage/commit/e307e4f487103d815e484291b3fda778ab9983bf"},{"source":"ghsa","sourceId":"GHSA-hmp2-4m7g-22cv","modified":"2026-10-07T18:15:12.169871159Z","url":"https://github.com/backstage/backstage/commit/e307e4f487103d815e484291b3fda778ab9983bf"},{"source":"redhat","sourceId":"CVE-2026-106503","modified":"2026-10-21T08:50:29+00:00","url":"https://github.com/backstage/backstage/commit/e307e4f487103d815e484291b3fda778ab9983bf"}]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.49.6","tags":["x_refsource_MISC","Patch","Release Notes","WEB","vendor-reference"],"source":"mitre","sourceId":"GitHub_M","modified":"2026-10-06T21:37:33.675Z","origins":[{"source":"mitre","sourceId":"GitHub_M","modified":"2026-10-06T21:37:33.675Z","url":"https://github.com/backstage/backstage/releases/tag/v1.49.6"},{"source":"nvd","sourceId":"CVE-2026-106503","modified":"2026-10-13T14:37:56.910","url":"https://github.com/backstage/backstage/releases/tag/v1.49.6"},{"source":"ghsa","sourceId":"GHSA-hmp2-4m7g-22cv","url":"https://github.com/backstage/backstage/releases/tag/v1.49.6"},{"source":"ghsa","sourceId":"GHSA-hmp2-4m7g-22cv","modified":"2026-10-07T18:15:12.169871159Z","url":"https://github.com/backstage/backstage/releases/tag/v1.49.6"},{"source":"redhat","sourceId":"CVE-2026-106503","modified":"2026-10-21T08:50:29+00:00","url":"https://github.com/backstage/backstage/releases/tag/v1.49.6"}]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.50.5","tags":["x_refsource_MISC","Patch","Release Notes","WEB","vendor-reference"],"source":"mitre","sourceId":"GitHub_M","modified":"2026-10-06T21:37:33.675Z","origins":[{"source":"mitre","sourceId":"GitHub_M","modified":"2026-10-06T21:37:33.675Z","url":"https://github.com/backstage/backstage/releases/tag/v1.50.5"},{"source":"nvd","sourceId":"CVE-2026-106503","modified":"2026-10-13T14:37:56.910","url":"https://github.com/backstage/backstage/releases/tag/v1.50.5"},{"source":"ghsa","sourceId":"GHSA-hmp2-4m7g-22cv","url":"https://github.com/backstage/backstage/releases/tag/v1.50.5"},{"source":"ghsa","sourceId":"GHSA-hmp2-4m7g-22cv","modified":"2026-10-07T18:15:12.169871159Z","url":"https://github.com/backstage/backstage/releases/tag/v1.50.5"},{"source":"redhat","sourceId":"CVE-2026-106503","modified":"2026-10-21T08:50:29+00:00","url":"https://github.com/backstage/backstage/releases/tag/v1.50.5"}]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.54.6","tags":["x_refsource_MISC","Patch","Release Notes","WEB","vendor-reference"],"source":"mitre","sourceId":"GitHub_M","modified":"2026-10-06T21:37:33.675Z","origins":[{"source":"mitre","sourceId":"GitHub_M","modified":"2026-10-06T21:37:33.675Z","url":"https://github.com/backstage/backstage/releases/tag/v1.54.6"},{"source":"nvd","sourceId":"CVE-2026-106503","modified":"2026-10-13T14:37:56.910","url":"https://github.com/backstage/backstage/releases/tag/v1.54.6"},{"source":"ghsa","sourceId":"GHSA-hmp2-4m7g-22cv","url":"https://github.com/backstage/backstage/releases/tag/v1.54.6"},{"source":"ghsa","sourceId":"GHSA-hmp2-4m7g-22cv","modified":"2026-10-07T18:15:12.169871159Z","url":"https://github.com/backstage/backstage/releases/tag/v1.54.6"},{"source":"redhat","sourceId":"CVE-2026-106503","modified":"2026-10-21T08:50:29+00:00","url":"https://github.com/backstage/backstage/releases/tag/v1.54.6"}]},{"url":"https://osv.dev/vulnerability/GHSA-hmp2-4m7g-22cv","tags":["ADVISORY"],"source":"ghsa","sourceId":"GHSA-hmp2-4m7g-22cv","modified":"2026-10-07T18:15:12.169871159Z","origins":[{"source":"ghsa","sourceId":"GHSA-hmp2-4m7g-22cv","url":"https://osv.dev/vulnerability/GHSA-hmp2-4m7g-22cv"},{"source":"ghsa","sourceId":"GHSA-hmp2-4m7g-22cv","modified":"2026-10-07T18:15:12.169871159Z","url":"https://osv.dev/vulnerability/GHSA-hmp2-4m7g-22cv"}]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106503","tags":["ADVISORY","vendor-reference"],"source":"ghsa","sourceId":"GHSA-hmp2-4m7g-22cv","modified":"2026-10-07T18:15:12.169871159Z","origins":[{"source":"ghsa","sourceId":"GHSA-hmp2-4m7g-22cv","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106503"},{"source":"ghsa","sourceId":"GHSA-hmp2-4m7g-22cv","modified":"2026-10-07T18:15:12.169871159Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106503"},{"source":"redhat","sourceId":"CVE-2026-106503","modified":"2026-10-21T08:50:29+00:00","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106503"}]},{"url":"https://github.com/backstage/backstage","tags":["PACKAGE"],"source":"ghsa","sourceId":"GHSA-hmp2-4m7g-22cv","modified":"2026-10-07T18:15:12.169871159Z","origins":[{"source":"ghsa","sourceId":"GHSA-hmp2-4m7g-22cv","url":"https://github.com/backstage/backstage"},{"source":"ghsa","sourceId":"GHSA-hmp2-4m7g-22cv","modified":"2026-10-07T18:15:12.169871159Z","url":"https://github.com/backstage/backstage"}]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106503.json","tags":["vendor-advisory"],"source":"redhat","sourceId":"CVE-2026-106503","modified":"2026-10-21T08:50:29+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-106503","modified":"2026-10-21T08:50:29+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106503.json"}]},{"url":"https://access.redhat.com/security/cve/CVE-2026-106503","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-106503","modified":"2026-10-21T08:50:29+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-106503","modified":"2026-10-21T08:50:29+00:00","url":"https://access.redhat.com/security/cve/CVE-2026-106503"}]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2547234","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-106503","modified":"2026-10-21T08:50:29+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-106503","modified":"2026-10-21T08:50:29+00:00","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2547234"}]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-106503","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-106503","modified":"2026-10-21T08:50:29+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-106503","modified":"2026-10-21T08:50:29+00:00","url":"https://www.cve.org/CVERecord?id=CVE-2026-106503"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:86675","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-106503","modified":"2026-10-21T08:50:29+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-106503","modified":"2026-10-21T08:50:29+00:00","url":"https://access.redhat.com/errata/RHSA-2026:86675"}]},{"source":"euvd","sourceId":"EUVD-2026-94068","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-94068","tags":["ADVISORY"],"origins":[{"source":"euvd","sourceId":"EUVD-2026-94068","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-94068"}]}],"packages":[{"source":"ghsa","sourceId":"GHSA-hmp2-4m7g-22cv","url":"https://osv.dev/vulnerability/GHSA-hmp2-4m7g-22cv","ecosystem":"npm","name":"@backstage/plugin-scaffolder-backend","purl":"pkg:npm/%40backstage/plugin-scaffolder-backend","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.3.1"}]}],"databaseSpecific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-hmp2-4m7g-22cv/GHSA-hmp2-4m7g-22cv.json"},"modified":"2026-10-07T18:15:12.169871159Z","origins":[{"source":"ghsa","sourceId":"GHSA-hmp2-4m7g-22cv","modified":"2026-10-07T18:15:12.169871159Z","url":"https://osv.dev/vulnerability/GHSA-hmp2-4m7g-22cv"}]},{"source":"ghsa","sourceId":"GHSA-hmp2-4m7g-22cv","url":"https://osv.dev/vulnerability/GHSA-hmp2-4m7g-22cv","ecosystem":"npm","name":"@backstage/plugin-scaffolder-backend","purl":"pkg:npm/%40backstage/plugin-scaffolder-backend","ranges":[{"type":"SEMVER","events":[{"introduced":"3.4.0"},{"fixed":"3.4.1"}]}],"databaseSpecific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-hmp2-4m7g-22cv/GHSA-hmp2-4m7g-22cv.json"},"modified":"2026-10-07T18:15:12.169871159Z","origins":[{"source":"ghsa","sourceId":"GHSA-hmp2-4m7g-22cv","modified":"2026-10-07T18:15:12.169871159Z","url":"https://osv.dev/vulnerability/GHSA-hmp2-4m7g-22cv"}]},{"source":"ghsa","sourceId":"GHSA-hmp2-4m7g-22cv","url":"https://osv.dev/vulnerability/GHSA-hmp2-4m7g-22cv","ecosystem":"npm","name":"@backstage/plugin-scaffolder-backend","purl":"pkg:npm/%40backstage/plugin-scaffolder-backend","ranges":[{"type":"SEMVER","events":[{"introduced":"4.0.0"},{"fixed":"4.0.3"}]}],"databaseSpecific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-hmp2-4m7g-22cv/GHSA-hmp2-4m7g-22cv.json"},"modified":"2026-10-07T18:15:12.169871159Z","origins":[{"source":"ghsa","sourceId":"GHSA-hmp2-4m7g-22cv","modified":"2026-10-07T18:15:12.169871159Z","url":"https://osv.dev/vulnerability/GHSA-hmp2-4m7g-22cv"}]},{"source":"ghsa","sourceId":"GHSA-hmp2-4m7g-22cv","url":"https://osv.dev/vulnerability/GHSA-hmp2-4m7g-22cv","ecosystem":"npm","name":"@backstage/plugin-scaffolder-backend","purl":"pkg:npm/%40backstage/plugin-scaffolder-backend","ranges":[{"type":"SEMVER","events":[{"introduced":"4.0.4"},{"fixed":"4.1.0"}]}],"databaseSpecific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-hmp2-4m7g-22cv/GHSA-hmp2-4m7g-22cv.json"},"modified":"2026-10-07T18:15:12.169871159Z","origins":[{"source":"ghsa","sourceId":"GHSA-hmp2-4m7g-22cv","modified":"2026-10-07T18:15:12.169871159Z","url":"https://osv.dev/vulnerability/GHSA-hmp2-4m7g-22cv"}]}],"pocCandidates":[],"cataloguedPoc":[],"vendorStatements":[{"source":"redhat","sourceId":"CVE-2026-106503","modified":"2026-10-21T08:50:29+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106503.json","productId":"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:17e885eb8a7c85fb67221a494bb3b5aba3d78c98029c90a1789d8b496240f9b7_amd64","product":"registry.redhat.io/ansible-automation-platform/automation-portal@sha256:17e885eb8a7c85fb67221a494bb3b5aba3d78c98029c90a1789d8b496240f9b7_amd64 as a component of Red Hat Ansible Automation Platform 2.2","status":"fixed","remediations":[{"category":"vendor_fix","details":"For more about Ansible plugins for Red Hat Developer Hub, see References links","url":"https://access.redhat.com/errata/RHSA-2026:86675"},{"category":"workaround","details":"To reduce the risk associated with this flaw:\n\n1. Restrict template access: Limit permissions to execute Scaffolder templates to trusted users by configuring role-based access control (RBAC) policies in Red Hat Developer Hub or Ansible Automation Platform.\n2. Enforce least privilege on integration credentials: Audit and restrict source control provider tokens (such as GitHub, GitLab, or Bitbucket credentials) to the minimum necessary repository scopes and permissions required for legitimate template actions.\n\nCaveats: Limiting integration credential permissions may cause templates that require administrative or elevated privileges to fail. Modifying credential secrets or configuration files within the deployment environment will require restarting the application pods for the new settings to take effect."}],"purl":"pkg:oci/automation-portal@sha256%3A17e885eb8a7c85fb67221a494bb3b5aba3d78c98029c90a1789d8b496240f9b7?arch=amd64&repository_url=registry.redhat.io/ansible-automation-platform/automation-portal&tag=1792523640","origins":[{"source":"redhat","sourceId":"CVE-2026-106503","modified":"2026-10-21T08:50:29+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106503.json"}]},{"source":"redhat","sourceId":"CVE-2026-106503","modified":"2026-10-21T08:50:29+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106503.json","productId":"red_hat_developer_hub:rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend","product":"rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend as a component of Red Hat Developer Hub","status":"known_affected","remediations":[{"category":"workaround","details":"To reduce the risk associated with this flaw:\n\n1. Restrict template access: Limit permissions to execute Scaffolder templates to trusted users by configuring role-based access control (RBAC) policies in Red Hat Developer Hub or Ansible Automation Platform.\n2. Enforce least privilege on integration credentials: Audit and restrict source control provider tokens (such as GitHub, GitLab, or Bitbucket credentials) to the minimum necessary repository scopes and permissions required for legitimate template actions.\n\nCaveats: Limiting integration credential permissions may cause templates that require administrative or elevated privileges to fail. Modifying credential secrets or configuration files within the deployment environment will require restarting the application pods for the new settings to take effect."},{"category":"none_available","details":"Affected"}],"purl":"pkg:oci/red-hat-developer-hub-backstage-plugin-orchestrator-backend?repository_url=registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend","origins":[{"source":"redhat","sourceId":"CVE-2026-106503","modified":"2026-10-21T08:50:29+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106503.json"}]},{"source":"redhat","sourceId":"CVE-2026-106503","modified":"2026-10-21T08:50:29+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106503.json","productId":"red_hat_developer_hub:rhdh/rhdh-hub-rhel9","product":"rhdh/rhdh-hub-rhel9 as a component of Red Hat Developer Hub","status":"known_affected","remediations":[{"category":"workaround","details":"To reduce the risk associated with this flaw:\n\n1. Restrict template access: Limit permissions to execute Scaffolder templates to trusted users by configuring role-based access control (RBAC) policies in Red Hat Developer Hub or Ansible Automation Platform.\n2. Enforce least privilege on integration credentials: Audit and restrict source control provider tokens (such as GitHub, GitLab, or Bitbucket credentials) to the minimum necessary repository scopes and permissions required for legitimate template actions.\n\nCaveats: Limiting integration credential permissions may cause templates that require administrative or elevated privileges to fail. Modifying credential secrets or configuration files within the deployment environment will require restarting the application pods for the new settings to take effect."},{"category":"none_available","details":"Affected"}],"purl":"pkg:oci/rhdh-hub-rhel9?repository_url=registry.redhat.io/rhdh/rhdh-hub-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-106503","modified":"2026-10-21T08:50:29+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106503.json"}]},{"source":"redhat","sourceId":"CVE-2026-106503","modified":"2026-10-21T08:50:29+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106503.json","productId":"self-service_automation_portal_2:ansible-automation-platform/bootc-automation-portal-rhel9","product":"ansible-automation-platform/bootc-automation-portal-rhel9 as a component of Self-service automation portal 2","status":"known_affected","remediations":[{"category":"workaround","details":"To reduce the risk associated with this flaw:\n\n1. Restrict template access: Limit permissions to execute Scaffolder templates to trusted users by configuring role-based access control (RBAC) policies in Red Hat Developer Hub or Ansible Automation Platform.\n2. Enforce least privilege on integration credentials: Audit and restrict source control provider tokens (such as GitHub, GitLab, or Bitbucket credentials) to the minimum necessary repository scopes and permissions required for legitimate template actions.\n\nCaveats: Limiting integration credential permissions may cause templates that require administrative or elevated privileges to fail. Modifying credential secrets or configuration files within the deployment environment will require restarting the application pods for the new settings to take effect."},{"category":"none_available","details":"Affected"}],"purl":"pkg:oci/bootc-automation-portal-rhel9?repository_url=registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-106503","modified":"2026-10-21T08:50:29+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106503.json"}]}],"vendorCoverage":{"total":4,"shown":4,"omitted":0,"source":"redhat"}}