9.6Critical
CVE-2026-106501Backstage: Sensitive information exposure in Scaffolder
Description
Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by sensitive information exposure in scaffolder. An authenticated Backstage user who can read another user's Scaffolder task may receive internal execution data. In deployments where that data contains credentials for an external service, this may permit disclosure and unauthorized changes in that external service. This issue is fixed in versions 3.3.1, 3.4.1, 4.0.3 and 4.1.0.
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| backstage | backstage | < 1.49.6, >= 1.50.0-next.0, < 1.50.5, >= 1.51.0-next.0, < 1.54.6 | |
| @backstage | plugin-scaffolder-backend | < 3.3.1, >= 3.4.0, < 3.4.1, >= 4.0.0, < 4.0.3, >= 4.0.4, < 4.1.0 | |
| linuxfoundation | backstage | < 1.49.6 | |
| linuxfoundation | backstage/plugin-scaffolder-backend | < 3.3.1 |
References and patches
- https://github.com/backstage/backstage/security/advisories/GHSA-g2v8-7jhw-pp8p MitigationVendor Advisory
- https://github.com/backstage/backstage/commit/66d2219edf0abe33ab7d0c1ced5d069d1e065be5 Patch
- https://github.com/backstage/backstage/commit/c19838870476a8e29144c84b1a5ac0654ec20fb5 Patch
- https://github.com/backstage/backstage/commit/e262d649981ff99bb01ca7077807ae3e25e85560 Patch
- https://github.com/backstage/backstage/releases/tag/v1.49.6 PatchRelease Notes
- https://github.com/backstage/backstage/releases/tag/v1.50.5 PatchRelease Notes
- https://github.com/backstage/backstage/releases/tag/v1.54.6 PatchRelease Notes
CPE matches (NVD) (7)
cpe:2.3:a:linuxfoundation:backstage\/plugin-scaffolder-backend:*:*:*:*:*:*:*:*< 3.3.1cpe:2.3:a:linuxfoundation:backstage\/plugin-scaffolder-backend:*:*:*:*:*:*:*:*≥ 3.4.0 < 3.4.1cpe:2.3:a:linuxfoundation:backstage\/plugin-scaffolder-backend:*:*:*:*:*:*:*:*≥ 4.0.0 < 4.0.3cpe:2.3:a:linuxfoundation:backstage\/plugin-scaffolder-backend:*:*:*:*:*:*:*:*≥ 4.0.4 < 4.1.0cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*< 1.49.6cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*≥ 1.50.0 < 1.50.5cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*≥ 1.51.0 < 1.54.6