All vulnerabilities
CVE-2026-106501GHSA-g2v8-7jhw-pp8p

@backstage/plugin-scaffolder-backend: Backstage: Sensitive information exposure in Scaffolder

backstage @backstage/plugin-scaffolder-backendnpmLibraries & packages
Open in ThreatlineRecord JSON
CVSS
9.6Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.48%Chance of exploitation activity in the next 30 days, higher than 40% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in3.3.1Also 3.4.1, 4.0.3 and 1 moreGitHub
Published6 Oct 2026Updated 7 Oct 2026CVE List

What fixes it

  • 3.3.1@backstage/plugin-scaffolder-backend, npmGitHubnpm install @backstage/plugin-scaffolder-backend@3.3.1
  • 3.4.1@backstage/plugin-scaffolder-backend, npmGitHubnpm install @backstage/plugin-scaffolder-backend@3.4.1
  • 4.0.3@backstage/plugin-scaffolder-backend, npmGitHubnpm install @backstage/plugin-scaffolder-backend@4.0.3
  • 4.1.0@backstage/plugin-scaffolder-backend, npmGitHubnpm install @backstage/plugin-scaffolder-backend@4.1.0

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Impact

An authenticated Backstage user who can read another user's Scaffolder task may receive internal execution data. In deployments where that data contains credentials for an external service, this may permit disclosure and unauthorized changes in that external service.

Patches

Patched in @backstage/plugin-scaffolder-backend version 4.1.0

Workarounds

  • Configure scaffolder.task.read with the isTaskOwner condition so users can only read tasks they created.
  • Restrict affected integrations and workflows to trusted operators until an upgrade is available.

Text from GitHub Advisory Database

Affected versions 15

  • @backstage/plugin-scaffolder-backend, npm< 3.3.1GitHub
  • @backstage/plugin-scaffolder-backend, npm>= 3.4.0, < 3.4.1GitHub
  • @backstage/plugin-scaffolder-backend, npm>= 4.0.0, < 4.0.3GitHub
  • @backstage/plugin-scaffolder-backend, npm>= 4.0.4, < 4.1.0GitHub
  • backstageaffected: < 1.49.6CVE List
  • backstageaffected: >= 1.50.0-next.0, < 1.50.5CVE List
  • backstageaffected: >= 1.51.0-next.0, < 1.54.6CVE List
  • plugin-scaffolder-backendaffected: < 3.3.1CVE List
  • plugin-scaffolder-backendaffected: >= 3.4.0, < 3.4.1CVE List
  • plugin-scaffolder-backendaffected: >= 4.0.0, < 4.0.3CVE List
  • plugin-scaffolder-backendaffected: >= 4.0.4, < 4.1.0CVE List
  • @backstage/plugin-scaffolder-backend, npmfrom first release, fixed in 3.3.1OSV
  • @backstage/plugin-scaffolder-backend, npmfrom 3.4.0, fixed in 3.4.1OSV
  • @backstage/plugin-scaffolder-backend, npmfrom 4.0.0, fixed in 4.0.3OSV
  • @backstage/plugin-scaffolder-backend, npmfrom 4.0.4, fixed in 4.1.0OSV

References 9