Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-106504 · GHSA-4xvq-3m68-h444

Backstage has sensitive information exposure in scaffolder task logs

Risk score
47/100
CVSS
6.5 v3.1
Exploit chance (30 days)
0.3%
Published
6 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by sensitive information exposure in scaffolder task logs. An authenticated user who can create and read scaffolder tasks may be able to observe sensitive values in task logs in d…
Affected
@backstage/plugin-scaffolder-backend (npm) < 4.1.0
Fix
Upgrade @backstage/plugin-scaffolder-backend to 4.1.0 or later.
Exploitation
No known exploitation

Story map

Story map: @backstage/plugin-scaffolder-backendTHE FLAWSTHE FIXCVE-2026-106504Backstage has sensitiveinformation exposure inscaffolder task logsCVSS 6.5 · EPSS 0%CVE-2026-106501Backstage: Sensitiveinformation exposure inScaffolderCVSS 9.6 · EPSS 0%CVE-2026-106500Backstage: Improper taskstate validation in ScaffolderbackendCVSS 8.5 · EPSS 0%CVE-2026-106503Backstage: Scaffolder actioninput authorization bypassCVSS 8.1 · EPSS 0%Upgrade…4.1.0 · 3.3.1 · 3.4.1 · 4.0.3or later on your release lineWho is exposed@backstage/plugin-scaffolder-backend (npm) < 3.3.1;@backstage/plugin-scaffolder-backend (npm) >= 3.4.0, < 3.4.1;@backstage/plugin-scaffolder…AMBER · PATCH THIS WEEK@backstage/plugin-scaffolder-ba…Backstage is an open frameworkfor building developer portals.Prior to 3.3.1, 3.4.1, 4.0.3 and4.1.0, the@backstage/plugin-scaffolder-backend package is affected bysensitive information exposure…Where it standsNo known exploitationCONNECTS TOSame weaknessCWE-532 (CWE-532)30 other warnings in 30 days →Same productEarlier @backstage/plugin-scaffolder-backendwarnings5 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

@backstage/plugin-scaffolder-backend: Amber, patch this week. Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by sensitive information exposure in scaffolder. An authenticated Backstage user who can read another user's Scaffolder task may receive internal execution…

The flaws

  • CVE-2026-106504: Backstage has sensitive information exposure in scaffolder task logs (CVSS 6.5 · EPSS 0%)
  • CVE-2026-106501: Backstage: Sensitive information exposure in Scaffolder (CVSS 9.6 · EPSS 0%)
  • CVE-2026-106500: Backstage: Improper task state validation in Scaffolder backend (CVSS 8.5 · EPSS 0%)
  • CVE-2026-106503: Backstage: Scaffolder action input authorization bypass (CVSS 8.1 · EPSS 0%)

The fix

Upgrade @backstage/plugin-scaffolder-backend: 4.1.0 · 3.3.1 · 3.4.1 · 4.0.3 or later on your release line

Who is exposed: @backstage/plugin-scaffolder-backend (npm) < 3.3.1; @backstage/plugin-scaffolder-backend (npm) >= 3.4.0, < 3.4.1; @backstage/plugin-scaffolder-backend (npm) >= 4.0.0, < 4.0.3; @backstage/plugin-scaffolder-backend (npm) >= 4.0.4, < 4.1.0

Where it stands

  • No known exploitation

Connects to

Why it is Yellow

  • CVSS 6.5 medium
  • On your watchlist: npm

Affected packages

PackageEcosystemVulnerableFixed in
@backstage/plugin-scaffolder-backendnpm< 4.1.04.1.0

References

Original description

Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by sensitive information exposure in scaffolder task logs. An authenticated user who can create and read scaffolder tasks may be able to observe sensitive values in task logs in deployments with restrictive action permissions and affected templates. Exploitation requires a denied action whose input contains such a value. This issue is fixed in version 4.1.0.

Last activity 6 Oct 2026. Patch Forecast updates every hour.