Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-106502 · GHSA-95p4-vv4g-jxxm

Backstage may expose sensitive information in Scaffolder task failure events

Risk score
41/100
CVSS
5.3 v3.1
Exploit chance (30 days)
0.3%
Published
6 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package could expose sensitive information in Scaffolder task failure events. Under specific template and failure conditions, an authenticated user may retrieve backend-managed credentials used durin…
Affected
@backstage/plugin-scaffolder-backend (npm) < 4.1.0
Fix
Upgrade @backstage/plugin-scaffolder-backend to 4.1.0 or later.
Exploitation
No known exploitation

Story map

Story map: @backstage/plugin-scaffolder-backendTHE FLAWSTHE FIXCVE-2026-106502Backstage may exposesensitive information inScaffolder task failure eventsCVSS 5.3 · EPSS 0%CVE-2026-106501Backstage: Sensitiveinformation exposure inScaffolderCVSS 9.6 · EPSS 0%CVE-2026-106500Backstage: Improper taskstate validation in ScaffolderbackendCVSS 8.5 · EPSS 0%CVE-2026-106503Backstage: Scaffolder actioninput authorization bypassCVSS 8.1 · EPSS 0%Upgrade…4.1.0 · 3.3.1 · 3.4.1 · 4.0.3or later on your release lineWho is exposed@backstage/plugin-scaffolder-backend (npm) < 3.3.1;@backstage/plugin-scaffolder-backend (npm) >= 3.4.0, < 3.4.1;@backstage/plugin-scaffolder…AMBER · PATCH THIS WEEK@backstage/plugin-scaffolder-ba…Backstage is an open frameworkfor building developer portals.Prior to 3.3.1, 3.4.1, 4.0.3 and4.1.0, the@backstage/plugin-scaffolder-backend package is affected bysensitive information exposure…Where it standsNo known exploitationCONNECTS TOSame weaknessCWE-532 (CWE-532)29 other warnings in 30 days →Same productEarlier @backstage/plugin-scaffolder-backendwarnings5 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

@backstage/plugin-scaffolder-backend: Amber, patch this week. Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by sensitive information exposure in scaffolder. An authenticated Backstage user who can read another user's Scaffolder task may receive internal execution…

The flaws

  • CVE-2026-106502: Backstage may expose sensitive information in Scaffolder task failure events (CVSS 5.3 · EPSS 0%)
  • CVE-2026-106501: Backstage: Sensitive information exposure in Scaffolder (CVSS 9.6 · EPSS 0%)
  • CVE-2026-106500: Backstage: Improper task state validation in Scaffolder backend (CVSS 8.5 · EPSS 0%)
  • CVE-2026-106503: Backstage: Scaffolder action input authorization bypass (CVSS 8.1 · EPSS 0%)

The fix

Upgrade @backstage/plugin-scaffolder-backend: 4.1.0 · 3.3.1 · 3.4.1 · 4.0.3 or later on your release line

Who is exposed: @backstage/plugin-scaffolder-backend (npm) < 3.3.1; @backstage/plugin-scaffolder-backend (npm) >= 3.4.0, < 3.4.1; @backstage/plugin-scaffolder-backend (npm) >= 4.0.0, < 4.0.3; @backstage/plugin-scaffolder-backend (npm) >= 4.0.4, < 4.1.0

Where it stands

  • No known exploitation

Connects to

Why it is Yellow

  • CVSS 5.3 medium
  • On your watchlist: npm

Affected packages

PackageEcosystemVulnerableFixed in
@backstage/plugin-scaffolder-backendnpm< 4.1.04.1.0

References

Original description

Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package could expose sensitive information in Scaffolder task failure events. Under specific template and failure conditions, an authenticated user may retrieve backend-managed credentials used during task execution from affected task events. This issue is fixed in version 4.1.0.

Last activity 6 Oct 2026. Patch Forecast updates every hour.