CVE-2026-106501

CRITICAL 9.6

Backstage: Sensitive information exposure in Scaffolder

CVSS Score

9.6

EPSS Score

0.0%

EPSS Percentile

0th

Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by sensitive information exposure in scaffolder. An authenticated Backstage user who can read another user's Scaffolder task may receive internal execution data. In deployments where that data contains credentials for an external service, this may permit disclosure and unauthorized changes in that external service. This issue is fixed in versions 3.3.1, 3.4.1, 4.0.3 and 4.1.0.

CWE	CWE-200 CWE-201
Vendor	backstage
Product	backstage
Published	Oct 6, 2026

Stay Ahead of the Next One

Get instant alerts for backstage backstage

Be the first to know when new critical vulnerabilities affecting backstage backstage are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Affected Versions

backstage / backstage

< 1.49.6 >= 1.50.0-next.0, < 1.50.5 >= 1.51.0-next.0, < 1.54.6

@backstage / plugin-scaffolder-backend

< 3.3.1 >= 3.4.0, < 3.4.1 >= 4.0.0, < 4.0.3 >= 4.0.4, < 4.1.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/backstage/backstage/security/advisories/GHSA-g2v8-7jhw-pp8p github.com: https://github.com/backstage/backstage/commit/66d2219edf0abe33ab7d0c1ced5d069d1e065be5 github.com: https://github.com/backstage/backstage/commit/c19838870476a8e29144c84b1a5ac0654ec20fb5 github.com: https://github.com/backstage/backstage/commit/e262d649981ff99bb01ca7077807ae3e25e85560 github.com: https://github.com/backstage/backstage/releases/tag/v1.49.6 github.com: https://github.com/backstage/backstage/releases/tag/v1.50.5 github.com: https://github.com/backstage/backstage/releases/tag/v1.54.6