Tóm tắt nhanh
- CVE-2026-106461 là lỗ hổng mức TRUNG BÌNH (CVSS 4.3) ảnh hưởng backstage (linuxfoundation), backstage/plugin-scaffolder-backend (linuxfoundation), @backstage/plugin-scaffolder-backend.
- Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.19%, cao hơn 9.0% các lỗ hổng khác.
- Cách xử lý: cập nhật lên 1.54.6, 4.1.0 hoặc mới hơn.
Mô tả
Impact
An authenticated internal user may be able to view metadata for scaffolder tasks outside the visibility intended by a deployment's permission policy. Stored task secrets are not included in the affected response, and no integrity or availability impact was identified.
Patches
Patched in @backstage/plugin-scaffolder-backend version 4.1.0
Workarounds
- Restrict the scaffolder task-list endpoint at the ingress or authenticating proxy to users who are permitted to view all tasks.
- Avoid placing sensitive values in template input parameters until the patched package is deployed.
Mô tả của NVD
Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by incorrect authorization in scaffolder task listing. An authenticated internal user may be able to view metadata for scaffolder tasks outside the visibility intended by a deployment's permission policy. Stored task secrets are not included in the affected response, and no integrity or availability impact was identified. This issue is fixed in version 4.1.0.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí