Backstage plugin-scaffolder-backend: Sensitive information exposure in Scaffolder
Summary
The Scaffolder plugin of Backstage, an open framework for developer portals, returns internal task execution data to users who can read another user's Scaffolder task. An authenticated user with a Backstage account can exploit this without user interaction. If the exposed data contains credentials for an external service, an attacker may access and change that external service.
Affected
- @backstage/plugin-scaffolder-backend before 3.3.1
- @backstage/plugin-scaffolder-backend 3.4.0 before 3.4.1
- @backstage/plugin-scaffolder-backend 4.0.0 before 4.0.3
- @backstage/plugin-scaffolder-backend 4.0.4 before 4.1.0
- Core Backstage ranges per CVE record: before 1.49.6; 1.50.0-next.0 to before 1.50.5; 1.51.0-next.0 to before 1.54.6 (not verified against vendor page)
Fixed in
- @backstage/plugin-scaffolder-backend 3.3.1
- @backstage/plugin-scaffolder-backend 3.4.1
- @backstage/plugin-scaffolder-backend 4.0.3
- @backstage/plugin-scaffolder-backend 4.1.0
Workaround
- Configure scaffolder.task.read with the isTaskOwner condition so users can only read their own tasks.
- Restrict affected integrations and workflows to trusted operators until an upgrade is available.
- Remove sensitive values from scaffolder.defaultEnvironment.secrets until a patched version is installed, if the restriction cannot be guaranteed (based on a related third-party advisory, not verified by the vendor).
Exploitation
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
- No known exploitation or public proof of concept found in the limited search.
- EPSS score reported by one aggregator: 0.00473.
Our recommendation
- Upgrade @backstage/plugin-scaffolder-backend to 4.1.0 or the patched version for your release line.
- Check whether scaffolder tasks store credentials for third-party services and rotate any exposed credentials.
- Apply the isTaskOwner condition as an interim measure if an upgrade is not possible.
- Review access to Backstage and restrict Scaffolder task visibility to trusted users.
- Monitor external services for unexpected changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-g2v8-7jhw-pp8p github.com
- Fix commit 66d2219 (serialize task responses explicitly) github.com
- Backstage release v1.54.6 github.com
- OSV record CVE-2026-106501 osv.dev
- GitLab Advisory Database CVE-2026-106501 advisories.gitlab.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 23:06.
Original description (NVD)
Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by sensitive information exposure in scaffolder. An authenticated Backstage user who can read another user's Scaffolder task may receive internal execution data. In deployments where that data contains credentials for an external service, this may permit disclosure and unauthorized changes in that external service. This issue is fixed in versions 3.3.1, 3.4.1, 4.0.3 and 4.1.0.
NVD references (7)
- https://github.com/backstage/backstage/commit/66d2219edf0abe33ab7d0c1ced5d069d1e065be5
- https://github.com/backstage/backstage/commit/c19838870476a8e29144c84b1a5ac0654ec20fb5
- https://github.com/backstage/backstage/commit/e262d649981ff99bb01ca7077807ae3e25e85560
- https://github.com/backstage/backstage/releases/tag/v1.49.6
- https://github.com/backstage/backstage/releases/tag/v1.50.5
- https://github.com/backstage/backstage/releases/tag/v1.54.6
- https://github.com/backstage/backstage/security/advisories/GHSA-g2v8-7jhw-pp8p
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.