En bref
- CVE-2026-106499 est une vulnérabilité MOYENNE (CVSS 4.9) touchant backstage (linuxfoundation), backstage/plugin-scaffolder-backend (linuxfoundation), @backstage/plugin-scaffolder-backend.
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.27%, plus élevée que 19.2% des vulnérabilités.
- Correctif : mettre à jour vers 1.54.6, 4.1.0 ou plus récent.
Description
Impact
Deployments that configure sensitive scaffolder.defaultEnvironment.secrets and allow an attacker to create or modify Scaffolder templates are affected. A template author could cause secret-derived values used during template iteration to be persisted in task logs, exposing those values to users with access to the resulting task logs.
Patches
Patched in @backstage/plugin-scaffolder-backend version 4.1.0
Workarounds
- Restrict permission to create or update Template entities to fully trusted parties, as recommended by the Backstage threat model.
- If that restriction cannot be guaranteed, remove sensitive values from
scaffolder.defaultEnvironment.secrets until a patched version is available.
No complete workaround is known that preserves both untrusted template authoring and access to sensitive default-environment secrets.
NVD description
Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package could expose secret-derived values in Scaffolder task logs. Deployments that configure sensitive scaffolder.defaultEnvironment.secrets and allow an attacker to create or modify Scaffolder templates are affected. A template author could cause secret-derived values used during template iteration to be persisted and exposed to users who can access the resulting task logs. This issue is fixed in version 4.1.0.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free