All vulnerabilities
CVE-2026-106506GHSA-vwp5-f99x-x3rq

@backstage/plugin-scaffolder-backend: Backstage has improper input validation in scaffolder task list ordering

backstage @backstage/plugin-scaffolder-backendnpmLibraries & packages
Open in ThreatlineRecord JSON
CVSS
5.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.22%Chance of exploitation activity in the next 30 days, higher than 11% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in4.1.0Fixed versionGitHub
Published6 Oct 2026Updated 7 Oct 2026CVE List

What fixes it

  • 4.1.0@backstage/plugin-scaffolder-backend, npmGitHubnpm install @backstage/plugin-scaffolder-backend@4.1.0

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Impact

An authenticated Backstage user with permission to create and read relevant scaffolder tasks may be able to infer confidential task data under specific conditions. Successful exploitation requires retained task secrets, visibility of a target task, knowledge of the secret structure, and repeated requests.

Patches

Patched in @backstage/plugin-scaffolder-backend version 4.1.0

Workarounds

  • At the gateway or reverse proxy, reject task-list requests that specify custom ordering, or allow ordering only by created_at, status, and created_by.
  • Restrict scaffolder task creation and task read permissions to trusted users, preferably using owner-based task-read conditions.
  • Disabling task recovery can reduce secret retention after a task is claimed, but it does not protect secrets in queued tasks and should not be treated as complete mitigation.

Text from GitHub Advisory Database

Affected versions 4

  • @backstage/plugin-scaffolder-backend, npm< 4.1.0GitHub
  • backstageaffected: < 1.54.6CVE List
  • plugin-scaffolder-backendaffected: < 4.1.0CVE List
  • @backstage/plugin-scaffolder-backend, npmfrom first release, fixed in 4.1.0OSV

References 5