Critical severity · published Oct 6, 2026
CVE-2026-106501
Backstage: Sensitive information exposure in Scaffolder
9.6
CVSS
0.5%
EPSS
No
On KEV
Description
Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by sensitive information exposure in scaffolder. An authenticated Backstage user who can read another user's Scaffolder task may receive internal execution data. In deployments where that data contains credentials for an external service, this may permit disclosure and unauthorized changes in that external service. This issue is fixed in versions 3.3.1, 3.4.1, 4.0.3 and 4.1.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BA
backstage · backstage
< 1.49.6; >= 1.50.0-next.0, < 1.50.5; >= 1.51.0-next.0, < 1.54.6 · source: vendor, NVD
PL
plugin-scaffolder-backend · @backstage
< 3.3.1; >= 3.4.0, < 3.4.1; >= 4.0.0, < 4.0.3; >= 4.0.4, < 4.1.0 · source: vendor
BA
Backstage/plugin-scaffolder-backend · Linuxfoundation
before 3.3.1; 3.4.0 before 3.4.1; 4.0.0 before 4.0.3; 4.0.4 before 4.1.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-106501
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-106501
x_refsource_CONFIRM
https://github.com/backstage/backstage/security/advisories/GHSA-g2v8-7jhw-pp8p
x_refsource_MISC
https://github.com/backstage/backstage/commit/66d2219edf0abe33ab7d0c1ced5d069d1e065be5
x_refsource_MISC
https://github.com/backstage/backstage/commit/c19838870476a8e29144c84b1a5ac0654ec20fb5
x_refsource_MISC
https://github.com/backstage/backstage/commit/e262d649981ff99bb01ca7077807ae3e25e85560
x_refsource_MISC
https://github.com/backstage/backstage/releases/tag/v1.49.6
x_refsource_MISC
https://github.com/backstage/backstage/releases/tag/v1.50.5
More from plugin-scaffolder-backend
8.5
CVE-2026-106500
Backstage: Improper task state validation in Scaffolder backend
8.1
CVE-2026-106503
Backstage: Scaffolder action input authorization bypass
6.5
CVE-2026-106504
Backstage: Sensitive information exposure in scaffolder task logs
6.4
CVE-2026-106462
Backstage: Scaffolder credential handling may allow unintended GitHub authentication fallback
5.3
CVE-2026-106506
Backstage: Improper input validation in scaffolder task list ordering