CVE-2026-106501: Backstage: Sensitive information exposure in Scaffolder
Backstage's @backstage/plugin-scaffolder-backend package has a sensitive information exposure flaw (CWE-200) in its scaffolder component. The record says an authenticated user who can read another user's Scaffolder task may receive internal execution data, which can include credentials for external services. The CNA rates it critical (9.6), and the record states it is fixed in 3.3.1, 3.4.1, 4.0.3 and 4.1.0.
Overview
Backstage is an open framework for building developer portals. This advisory concerns sensitive information exposure in the scaffolder component, specifically the @backstage/plugin-scaffolder-backend package. According to the record, an authenticated user who can read another user's Scaffolder task may receive internal execution data.
Impact
The record states that when that internal data contains credentials for an external service, disclosure and unauthorized changes in that external service may become possible. The CNA rates the issue critical with a base score of 9.6 under CVSS, and the associated weakness is CWE-200 (Exposure of Sensitive Information).
Affected products and versions
- @backstage/plugin-scaffolder-backend: the description says versions prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0 are affected.
- Backstage core packages in the affected data: before 1.49.6; from 1.50.0-next.0 up to before 1.50.5; from 1.51.0-next.0 up to before 1.54.6.
- Scaffolder backend ranges in the affected data: before 3.3.1; from 3.4.0 up to before 3.4.1; from 4.0.0 up to before 4.0.3; from 4.0.4 up to before 4.1.0.
- Fixed versions named in the record: 3.3.1, 3.4.1, 4.0.3 and 4.1.0 for the scaffolder plugin, and the Backstage release tags 1.49.6, 1.50.5 and 1.54.6.
Exploitation status
This CVE is not listed in the CISA KEV catalog in the record, so active exploitation is not confirmed. No confirmed exploitation appears in the sources consulted. The EPSS probability is 0.00483 (percentile 0.40716, dated 2026-10-23), and the SSVC fields record exploitation as none and automatable as no.
Remediation and mitigation
- Upgrade the scaffolder backend to the fixed version for your release line: 3.3.1, 3.4.1, 4.0.3 or 4.1.0.
- For Backstage core, move to 1.49.6, 1.50.5 or 1.54.6 according to your release line.
- The vendor advisory GHSA-g2v8-7jhw-pp8p is listed as a mitigation reference; the record does not describe its content.
- As a precaution, consider rotating credentials for external services that may have been stored in Scaffolder task data, since the record says such data can contain them.
Detection guidance
- Review access logs and audit records for reads of Scaffolder tasks by users who are not the task owner.
- Check whether task execution data holds credentials for external services, and review those services for unexpected changes.
- Monitor for unusual task lookups during the period before patching.
Limitations of the available information
- The record does not detail which exact fields are exposed or the precise authorization flaw.
- The scaffolder affected ranges list from 4.0.4 up to before 4.1.0 as affected, which conflicts with 4.0.3 being the fixed version on the same line; confirm your exact version against the vendor advisory.
- Entries labeled 'Linuxfoundation' repeat the Backstage product names without explanation in the record.
- No CISA ADP information or commit content is included in the record.
Frequently asked questions
Is this Backstage Scaffolder flaw being actively exploited?
The record lists it as not in the CISA KEV catalog, so active exploitation is not confirmed. No confirmed exploitation appears in the sources consulted.
Which versions should I update to?
The record names 3.3.1, 3.4.1, 4.0.3 and 4.1.0 for the scaffolder plugin, and 1.49.6, 1.50.5 and 1.54.6 for Backstage release tags. Check your release line against the vendor advisory.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.