Vulnerability · Published Oct 6, 2026 · Assigned by GitHub_M

CVE-2026-106504Backstage: Sensitive information exposure in scaffolder task logs

Medium 6.5

In plain English

A medium-severity sensitive data in logs in backstage from backstage. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.3%top 82.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by sensitive information exposure in scaffolder task logs. An authenticated user who can create and read scaffolder tasks may be able to observe sensitive values in task logs in deployments with restrictive action permissions and affected templates. Exploitation requires a denied action whose input contains such a value. This issue is fixed in version 4.1.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	@backstage/plugin-scaffolder-backend	4.1.0	GHSA-4xvq-3m68-h444

Affected products (as reported)

Vendor	Product	Versions
backstage	backstage	< 1.54.6
@backstage	plugin-scaffolder-backend	< 4.1.0

Weakness: CWE-532 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

https://github.com/backstage/backstage/security/advisories/GHSA-4xvq-3m68-h444 x_refsource_CONFIRM
https://github.com/backstage/backstage/commit/3eb3dc59eb0da0deccd532f19eb460bb452c9efb x_refsource_MISC
https://github.com/backstage/backstage/releases/tag/v1.54.6 x_refsource_MISC