Backstage may expose sensitive information in Scaffolder task failure events

MEDIUM 5.3CVE-2026-106502 · GHSA-95p4-vv4g-jxxm · Published 06/10/2026 · updated 13/10/2026

Package	Affected versions	Patched versions
backstage linuxfoundation	`< 1.54.6`	`1.54.6`
backstage/plugin-scaffolder-backend linuxfoundation	`< 4.1.0`	`4.1.0`
@backstage/plugin-scaffolder-backend npm	`< 4.1.0`	`4.1.0`

Description

Impact

Under specific template and failure conditions, an authenticated user may be able to retrieve sensitive values from Scaffolder task events. This can expose backend-managed credentials used during task execution.

Patches

Patched in @backstage/plugin-scaffolder-backend version 4.1.0

Workarounds

Restrict Scaffolder template execution and task-event access to trusted users until the patched version is deployed.

NVD description

Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package could expose sensitive information in Scaffolder task failure events. Under specific template and failure conditions, an authenticated user may retrieve backend-managed credentials used during task execution from affected task events. This issue is fixed in version 4.1.0.

References

backstage/backstage security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2026-106502 · ADVISORY
backstage/backstage commit 3f1e869 · WEB
backstage/backstage · PACKAGE
backstage/backstage release v1.54.6 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

backstage

linuxfoundation

< 1.54.6

1.54.6

backstage/plugin-scaffolder-backend

linuxfoundation

< 4.1.0

4.1.0

@backstage/plugin-scaffolder-backend

npm

< 4.1.0

4.1.0

Description

Impact

Patches

Patched in @backstage/plugin-scaffolder-backend version 4.1.0

Workarounds

Restrict Scaffolder template execution and task-event access to trusted users until the patched version is deployed.

NVD description