{"schema":"vulnpedia.research/1","cve":"CVE-2026-106504","generated":"2026-10-26T13:52:32.101Z","references":[{"url":"https://github.com/backstage/backstage/security/advisories/GHSA-4xvq-3m68-h444","tags":["x_refsource_CONFIRM","Mitigation","Vendor Advisory","WEB","vendor-reference"],"source":"mitre","sourceId":"GitHub_M","modified":"2026-10-06T21:40:15.510Z","origins":[{"source":"mitre","sourceId":"GitHub_M","modified":"2026-10-06T21:40:15.510Z","url":"https://github.com/backstage/backstage/security/advisories/GHSA-4xvq-3m68-h444"},{"source":"nvd","sourceId":"CVE-2026-106504","modified":"2026-10-13T21:08:57.650","url":"https://github.com/backstage/backstage/security/advisories/GHSA-4xvq-3m68-h444"},{"source":"ghsa","sourceId":"GHSA-4xvq-3m68-h444","url":"https://github.com/backstage/backstage/security/advisories/GHSA-4xvq-3m68-h444"},{"source":"ghsa","sourceId":"GHSA-4xvq-3m68-h444","modified":"2026-10-07T16:30:05.290352985Z","url":"https://github.com/backstage/backstage/security/advisories/GHSA-4xvq-3m68-h444"},{"source":"redhat","sourceId":"CVE-2026-106504","modified":"2026-10-08T23:53:31+00:00","url":"https://github.com/backstage/backstage/security/advisories/GHSA-4xvq-3m68-h444"}]},{"url":"https://github.com/backstage/backstage/commit/3eb3dc59eb0da0deccd532f19eb460bb452c9efb","tags":["x_refsource_MISC","Patch","WEB","vendor-reference"],"source":"mitre","sourceId":"GitHub_M","modified":"2026-10-06T21:40:15.510Z","origins":[{"source":"mitre","sourceId":"GitHub_M","modified":"2026-10-06T21:40:15.510Z","url":"https://github.com/backstage/backstage/commit/3eb3dc59eb0da0deccd532f19eb460bb452c9efb"},{"source":"nvd","sourceId":"CVE-2026-106504","modified":"2026-10-13T21:08:57.650","url":"https://github.com/backstage/backstage/commit/3eb3dc59eb0da0deccd532f19eb460bb452c9efb"},{"source":"ghsa","sourceId":"GHSA-4xvq-3m68-h444","url":"https://github.com/backstage/backstage/commit/3eb3dc59eb0da0deccd532f19eb460bb452c9efb"},{"source":"ghsa","sourceId":"GHSA-4xvq-3m68-h444","modified":"2026-10-07T16:30:05.290352985Z","url":"https://github.com/backstage/backstage/commit/3eb3dc59eb0da0deccd532f19eb460bb452c9efb"},{"source":"redhat","sourceId":"CVE-2026-106504","modified":"2026-10-08T23:53:31+00:00","url":"https://github.com/backstage/backstage/commit/3eb3dc59eb0da0deccd532f19eb460bb452c9efb"}]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.54.6","tags":["x_refsource_MISC","Patch","Release Notes","WEB","vendor-reference"],"source":"mitre","sourceId":"GitHub_M","modified":"2026-10-06T21:40:15.510Z","origins":[{"source":"mitre","sourceId":"GitHub_M","modified":"2026-10-06T21:40:15.510Z","url":"https://github.com/backstage/backstage/releases/tag/v1.54.6"},{"source":"nvd","sourceId":"CVE-2026-106504","modified":"2026-10-13T21:08:57.650","url":"https://github.com/backstage/backstage/releases/tag/v1.54.6"},{"source":"ghsa","sourceId":"GHSA-4xvq-3m68-h444","url":"https://github.com/backstage/backstage/releases/tag/v1.54.6"},{"source":"ghsa","sourceId":"GHSA-4xvq-3m68-h444","modified":"2026-10-07T16:30:05.290352985Z","url":"https://github.com/backstage/backstage/releases/tag/v1.54.6"},{"source":"redhat","sourceId":"CVE-2026-106504","modified":"2026-10-08T23:53:31+00:00","url":"https://github.com/backstage/backstage/releases/tag/v1.54.6"}]},{"url":"https://osv.dev/vulnerability/GHSA-4xvq-3m68-h444","tags":["ADVISORY"],"source":"ghsa","sourceId":"GHSA-4xvq-3m68-h444","modified":"2026-10-07T16:30:05.290352985Z","origins":[{"source":"ghsa","sourceId":"GHSA-4xvq-3m68-h444","url":"https://osv.dev/vulnerability/GHSA-4xvq-3m68-h444"},{"source":"ghsa","sourceId":"GHSA-4xvq-3m68-h444","modified":"2026-10-07T16:30:05.290352985Z","url":"https://osv.dev/vulnerability/GHSA-4xvq-3m68-h444"}]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106504","tags":["ADVISORY","vendor-reference"],"source":"ghsa","sourceId":"GHSA-4xvq-3m68-h444","modified":"2026-10-07T16:30:05.290352985Z","origins":[{"source":"ghsa","sourceId":"GHSA-4xvq-3m68-h444","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106504"},{"source":"ghsa","sourceId":"GHSA-4xvq-3m68-h444","modified":"2026-10-07T16:30:05.290352985Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106504"},{"source":"redhat","sourceId":"CVE-2026-106504","modified":"2026-10-08T23:53:31+00:00","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106504"}]},{"url":"https://github.com/backstage/backstage","tags":["PACKAGE"],"source":"ghsa","sourceId":"GHSA-4xvq-3m68-h444","modified":"2026-10-07T16:30:05.290352985Z","origins":[{"source":"ghsa","sourceId":"GHSA-4xvq-3m68-h444","url":"https://github.com/backstage/backstage"},{"source":"ghsa","sourceId":"GHSA-4xvq-3m68-h444","modified":"2026-10-07T16:30:05.290352985Z","url":"https://github.com/backstage/backstage"}]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106504.json","tags":["vendor-advisory"],"source":"redhat","sourceId":"CVE-2026-106504","modified":"2026-10-08T23:53:31+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-106504","modified":"2026-10-08T23:53:31+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106504.json"}]},{"url":"https://access.redhat.com/security/cve/CVE-2026-106504","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-106504","modified":"2026-10-08T23:53:31+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-106504","modified":"2026-10-08T23:53:31+00:00","url":"https://access.redhat.com/security/cve/CVE-2026-106504"}]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2547225","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-106504","modified":"2026-10-08T23:53:31+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-106504","modified":"2026-10-08T23:53:31+00:00","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2547225"}]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-106504","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-106504","modified":"2026-10-08T23:53:31+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-106504","modified":"2026-10-08T23:53:31+00:00","url":"https://www.cve.org/CVERecord?id=CVE-2026-106504"}]},{"source":"euvd","sourceId":"EUVD-2026-94069","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-94069","tags":["ADVISORY"],"origins":[{"source":"euvd","sourceId":"EUVD-2026-94069","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-94069"}]}],"packages":[{"source":"ghsa","sourceId":"GHSA-4xvq-3m68-h444","url":"https://osv.dev/vulnerability/GHSA-4xvq-3m68-h444","ecosystem":"npm","name":"@backstage/plugin-scaffolder-backend","purl":"pkg:npm/%40backstage/plugin-scaffolder-backend","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.1.0"}]}],"databaseSpecific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-4xvq-3m68-h444/GHSA-4xvq-3m68-h444.json"},"modified":"2026-10-07T16:30:05.290352985Z","origins":[{"source":"ghsa","sourceId":"GHSA-4xvq-3m68-h444","modified":"2026-10-07T16:30:05.290352985Z","url":"https://osv.dev/vulnerability/GHSA-4xvq-3m68-h444"}]}],"pocCandidates":[],"cataloguedPoc":[],"vendorStatements":[{"source":"redhat","sourceId":"CVE-2026-106504","modified":"2026-10-08T23:53:31+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106504.json","productId":"red_hat_developer_hub:rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend","product":"rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend as a component of Red Hat Developer Hub","status":"known_affected","remediations":[{"category":"workaround","details":"To mitigate this issue, implement operational and access control restrictions:\n\n1. Restrict scaffolder task creation and task log viewing permissions exclusively to trusted users through the application permission policy framework.\n2. Review scaffolder templates to avoid passing sensitive credentials or secrets into inputs of actions that are subject to permission denials.\n\nCaveats: Restricting task creation and log inspection permissions limits self-service scaffolding capabilities for standard portal users."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/red-hat-developer-hub-backstage-plugin-orchestrator-backend?repository_url=registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend","origins":[{"source":"redhat","sourceId":"CVE-2026-106504","modified":"2026-10-08T23:53:31+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106504.json"}]},{"source":"redhat","sourceId":"CVE-2026-106504","modified":"2026-10-08T23:53:31+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106504.json","productId":"red_hat_developer_hub:rhdh/rhdh-hub-rhel9","product":"rhdh/rhdh-hub-rhel9 as a component of Red Hat Developer Hub","status":"known_affected","remediations":[{"category":"workaround","details":"To mitigate this issue, implement operational and access control restrictions:\n\n1. Restrict scaffolder task creation and task log viewing permissions exclusively to trusted users through the application permission policy framework.\n2. Review scaffolder templates to avoid passing sensitive credentials or secrets into inputs of actions that are subject to permission denials.\n\nCaveats: Restricting task creation and log inspection permissions limits self-service scaffolding capabilities for standard portal users."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/rhdh-hub-rhel9?repository_url=registry.redhat.io/rhdh/rhdh-hub-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-106504","modified":"2026-10-08T23:53:31+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106504.json"}]},{"source":"redhat","sourceId":"CVE-2026-106504","modified":"2026-10-08T23:53:31+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106504.json","productId":"self-service_automation_portal_2:ansible-automation-platform/automation-portal","product":"ansible-automation-platform/automation-portal as a component of Self-service automation portal 2","status":"known_affected","remediations":[{"category":"workaround","details":"To mitigate this issue, implement operational and access control restrictions:\n\n1. Restrict scaffolder task creation and task log viewing permissions exclusively to trusted users through the application permission policy framework.\n2. Review scaffolder templates to avoid passing sensitive credentials or secrets into inputs of actions that are subject to permission denials.\n\nCaveats: Restricting task creation and log inspection permissions limits self-service scaffolding capabilities for standard portal users."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/automation-portal?repository_url=registry.redhat.io/ansible-automation-platform/automation-portal","origins":[{"source":"redhat","sourceId":"CVE-2026-106504","modified":"2026-10-08T23:53:31+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106504.json"}]},{"source":"redhat","sourceId":"CVE-2026-106504","modified":"2026-10-08T23:53:31+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106504.json","productId":"self-service_automation_portal_2:ansible-automation-platform/bootc-automation-portal-rhel9","product":"ansible-automation-platform/bootc-automation-portal-rhel9 as a component of Self-service automation portal 2","status":"known_affected","remediations":[{"category":"workaround","details":"To mitigate this issue, implement operational and access control restrictions:\n\n1. Restrict scaffolder task creation and task log viewing permissions exclusively to trusted users through the application permission policy framework.\n2. Review scaffolder templates to avoid passing sensitive credentials or secrets into inputs of actions that are subject to permission denials.\n\nCaveats: Restricting task creation and log inspection permissions limits self-service scaffolding capabilities for standard portal users."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/bootc-automation-portal-rhel9?repository_url=registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-106504","modified":"2026-10-08T23:53:31+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106504.json"}]}],"vendorCoverage":{"total":4,"shown":4,"omitted":0,"source":"redhat"}}