Sensitive Information Exposure in Backstage Scaffolder Plugin
CVE-2026-106501
9.6CRITICAL
What is CVE-2026-106501?
The @backstage/plugin-scaffolder-backend package in Backstage is vulnerable to sensitive information exposure prior to version 3.3.1, 3.4.1, 4.0.3, and 4.1.0. Authenticated users may access another user's Scaffolder task and potentially retrieve internal execution data. If this data includes credentials for an external service, it can lead to unauthorized changes or data breaches in those services. To mitigate this risk, users should update to the latest patched versions.
Affected Version(s)
backstage < 1.49.6 < 1.49.6
backstage >= 1.50.0-next.0, < 1.50.5 < 1.50.0-next.0, 1.50.5
backstage >= 1.51.0-next.0, < 1.54.6 < 1.51.0-next.0, 1.54.6