All vulnerabilities
CVE-2026-106502GHSA-95p4-vv4g-jxxm

@backstage/plugin-scaffolder-backend: Backstage may expose sensitive information in Scaffolder task failure events

backstage @backstage/plugin-scaffolder-backendnpmLibraries & packages
Open in ThreatlineRecord JSON
CVSS
5.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.29%Chance of exploitation activity in the next 30 days, higher than 20% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in4.1.0Fixed versionGitHub
Published6 Oct 2026Updated 7 Oct 2026CVE List

What fixes it

  • 4.1.0@backstage/plugin-scaffolder-backend, npmGitHubnpm install @backstage/plugin-scaffolder-backend@4.1.0

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Impact

Under specific template and failure conditions, an authenticated user may be able to retrieve sensitive values from Scaffolder task events. This can expose backend-managed credentials used during task execution.

Patches

Patched in @backstage/plugin-scaffolder-backend version 4.1.0

Workarounds

  • Restrict Scaffolder template execution and task-event access to trusted users until the patched version is deployed.

Text from GitHub Advisory Database

Affected versions 4

  • @backstage/plugin-scaffolder-backend, npm< 4.1.0GitHub
  • backstageaffected: < 1.54.6CVE List
  • plugin-scaffolder-backendaffected: < 4.1.0CVE List
  • @backstage/plugin-scaffolder-backend, npmfrom first release, fixed in 4.1.0OSV

References 5