要点
- CVE-2026-106461 は backstage (linuxfoundation), backstage/plugin-scaffolder-backend (linuxfoundation), @backstage/plugin-scaffolder-backend に影響する深刻度「中」 (CVSS 4.3) の脆弱性です。
- 今後30日間に悪用される確率（EPSS）：0.19%（全脆弱性の 9.0% より高い）。
- 対処：1.54.6, 4.1.0 以降に更新してください。
概要
Impact
An authenticated internal user may be able to view metadata for scaffolder tasks outside the visibility intended by a deployment's permission policy. Stored task secrets are not included in the affected response, and no integrity or availability impact was identified.
Patches
Patched in @backstage/plugin-scaffolder-backend version 4.1.0
Workarounds
- Restrict the scaffolder task-list endpoint at the ingress or authenticating proxy to users who are permitted to view all tasks.
- Avoid placing sensitive values in template input parameters until the patched package is deployed.
NVD の説明
Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by incorrect authorization in scaffolder task listing. An authenticated internal user may be able to view metadata for scaffolder tasks outside the visibility intended by a deployment's permission policy. Stored task secrets are not included in the affected response, and no integrity or availability impact was identified. This issue is fixed in version 4.1.0.
これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン