GHSA-g2v8-7jhw-pp8p CVE-2026-106501

Backstage: Sensitive information exposure in Scaffolder

Critical npm

Severity: 9.6 / 10; Critical · CVSS 3.1
Exploit chance (EPSS): 0.48%; Chance of exploitation in the next 30 days. Higher than 41.70% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor; CWE-201 Insertion of Sensitive Information Into Sent Data
Fix: 3.3.1; Upgrade @backstage/plugin-scaffolder-backend to this version or later

Description

Impact

An authenticated Backstage user who can read another user's Scaffolder task may receive internal execution data. In deployments where that data contains credentials for an external service, this may permit disclosure and unauthorized changes in that external service.

Patches

Patched in @backstage/plugin-scaffolder-backend version 4.1.0

Workarounds

Configure scaffolder.task.read with the isTaskOwner condition so users can only read tasks they created.
Restrict affected integrations and workflows to trusted operators until an upgrade is available.

Affected versions

npm

Package	Vulnerable	Fixed in
@backstage/plugin-scaffolder-backend	`< 3.3.1`	`3.3.1`
@backstage/plugin-scaffolder-backend	`>= 3.4.0, < 3.4.1`	`3.4.1`
@backstage/plugin-scaffolder-backend	`>= 4.0.0, < 4.0.3`	`4.0.3`
@backstage/plugin-scaffolder-backend	`>= 4.0.4, < 4.1.0`	`4.1.0`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

@backstage/plugin-scaffolder-backend npm → `3.3.1`

npm

npm install @backstage/plugin-scaffolder-backend@3.3.1

yarn

yarn add @backstage/plugin-scaffolder-backend@3.3.1

pnpm

pnpm add @backstage/plugin-scaffolder-backend@3.3.1

Severity breakdown

CVSS 3.1 9.6

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Attack vector: Network
Attack complexity: Low
Privileges required: Low
User interaction: None
Scope: Changed
Confidentiality: High
Integrity: High
Availability: None

Weakness

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

How to prevent it

Architecture and Design: Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

CWE-201: Insertion of Sensitive Information Into Sent Data

The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.

How to prevent it

Requirements: Specify which data in the software should be regarded as sensitive. Consider which types of users should have access to which types of data.
Implementation: Ensure that any possibly sensitive data specified in the requirements is verified with designers to ensure that it is either a calculated risk or mitigated elsewhere. Any information that is not necessary to the functionality should be removed in order to lower both the overhead and the possibility of security sensitive data being sent.
System Configuration: Setup default error messages so that unexpected errors do not disclose sensitive information.
Architecture and Design: Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

References

Advisories

nvd.nist.gov/vuln/detail/CVE-2026-106501

Packages

github.com/backstage/backstage

Timeline

Oct 6, 2026 Published
Oct 13, 2026 Last updated by the source
Oct 31, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-vwp5-f99x-x3rq Backstage has improper input validation in scaffolder task list ordering	Medium	Also affects @backstage/plugin-scaffolder-backend
GHSA-4xvq-3m68-h444 Backstage has sensitive information exposure in scaffolder task logs	Medium	Also affects @backstage/plugin-scaffolder-backend
GHSA-hmp2-4m7g-22cv Backstage: Scaffolder action input authorization bypass	High	Also affects @backstage/plugin-scaffolder-backend
GHSA-95p4-vv4g-jxxm Backstage may expose sensitive information in Scaffolder task failure events	Medium	Also affects @backstage/plugin-scaffolder-backend
GHSA-xvgh-hmx8-9xxf Backstage: Improper task state validation in Scaffolder backend	High	Also affects @backstage/plugin-scaffolder-backend
GHSA-mfvq-x7vr-rgqg Backstage: Secret-derived values may be exposed in scaffolder task logs	Medium	Also affects @backstage/plugin-scaffolder-backend
GHSA-29gx-h2m3-xw44 Backstage's scaffolder credential handling may allow unintended GitHub authentication fallback	Medium	Also affects @backstage/plugin-scaffolder-backend
GHSA-7hfw-grcm-cqm6 Backstage: Incorrect authorization in scaffolder task listing	Medium	Also affects @backstage/plugin-scaffolder-backend

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor