Log in Start free

Vulnerability · Published Oct 6, 2026 · Assigned by GitHub_M

CVE-2026-106501Backstage: Sensitive information exposure in Scaffolder

Critical 9.6

In plain English

A critical-severity information exposure in backstage from backstage. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.6Critical
Exploit odds (30 days)0.5%top 58.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by sensitive information exposure in scaffolder. An authenticated Backstage user who can read another user's Scaffolder task may receive internal execution data. In deployments where that data contains credentials for an external service, this may permit disclosure and unauthorized changes in that external service. This issue is fixed in versions 3.3.1, 3.4.1, 4.0.3 and 4.1.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
npm@backstage/plugin-scaffolder-backend3.3.1GHSA-g2v8-7jhw-pp8p
npm@backstage/plugin-scaffolder-backend3.4.1GHSA-g2v8-7jhw-pp8p
npm@backstage/plugin-scaffolder-backend4.0.3GHSA-g2v8-7jhw-pp8p
npm@backstage/plugin-scaffolder-backend4.1.0GHSA-g2v8-7jhw-pp8p

Affected products (as reported)

VendorProductVersions
backstage backstage < 1.49.6>= 1.50.0-next.0, < 1.50.5>= 1.51.0-next.0, < 1.54.6
@backstage plugin-scaffolder-backend < 3.3.1>= 3.4.0, < 3.4.1>= 4.0.0, < 4.0.3>= 4.0.4, < 4.1.0

Weakness: CWE-200, CWE-201 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

References