CVE-2026-106501 · GHSA-g2v8-7jhw-pp8p
Backstage: Sensitive information exposure in Scaffolder
- Risk score
- 71/100
- CVSS
- 9.6 v3.1
- Exploit chance (30 days)
- 0.5%
- Published
- 6 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by sensitive information exposure in scaffolder. An authenticated Backstage user who can read another user's Scaffolder task may receive internal execution…
- Affected
- @backstage/plugin-scaffolder-backend (npm) < 3.3.1; @backstage/plugin-scaffolder-backend (npm) >= 3.4.0, < 3.4.1; @backstage/plugin-scaffolder-backend (npm) >= 4.0.0, < 4.0.3; @backstage/plugin-scaffolder-backend (npm) >= 4.0.4, < 4.1.0
- Fix
- Upgrade @backstage/plugin-scaffolder-backend to 3.3.1 or 3.4.1 or 4.0.3 or 4.1.0 (whichever matches your release line) or later.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 9.6 critical
- On your watchlist: npm
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| @backstage/plugin-scaffolder-backend | npm | < 3.3.1 | 3.3.1 |
| @backstage/plugin-scaffolder-backend | npm | >= 3.4.0, < 3.4.1 | 3.4.1 |
| @backstage/plugin-scaffolder-backend | npm | >= 4.0.0, < 4.0.3 | 4.0.3 |
| @backstage/plugin-scaffolder-backend | npm | >= 4.0.4, < 4.1.0 | 4.1.0 |
References
- https://github.com/advisories/GHSA-g2v8-7jhw-pp8p
- https://github.com/backstage/backstage/security/advisories/GHSA-g2v8-7jhw-pp8p
- https://nvd.nist.gov/vuln/detail/CVE-2026-106501
- https://github.com/backstage/backstage/commit/66d2219edf0abe33ab7d0c1ced5d069d1e065be5
- https://github.com/backstage/backstage/commit/c19838870476a8e29144c84b1a5ac0654ec20fb5
- https://github.com/backstage/backstage/commit/e262d649981ff99bb01ca7077807ae3e25e85560
- https://github.com/backstage/backstage/releases/tag/v1.49.6
- https://github.com/backstage/backstage/releases/tag/v1.50.5
- https://github.com/backstage/backstage/releases/tag/v1.54.6
- https://github.com/advisories/GHSA-g2v8-7jhw-pp8p
Original description
Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by sensitive information exposure in scaffolder. An authenticated Backstage user who can read another user's Scaffolder task may receive internal execution data. In deployments where that data contains credentials for an external service, this may permit disclosure and unauthorized changes in that external service. This issue is fixed in versions 3.3.1, 3.4.1, 4.0.3 and 4.1.0.
Last activity 6 Oct 2026. Patch Forecast updates every hour.