Developer Portal Vulnerability in Backstage by Spotify

CVE-2026-106499

What is CVE-2026-106499?

The @backstage/plugin-scaffolder-backend package in Backstage prior to version 4.1.0 may reveal sensitive, secret-derived information within Scaffolder task logs. Specifically, if deployments are configured to manage sensitive environment secrets and if an attacker has permissions to create or adjust Scaffolder templates, they could introduce templates that lead to the unauthorized exposure of these secret-derived values. This serious flaw enables compromised logs that can be accessed by users with sufficient permissions, potentially jeopardizing sensitive data and system integrity. The vulnerability has been addressed in version 4.1.0.

References