Independent & educational platform Not a government body. No link or affiliation with any government organisation. Made for learning only. Test only systems you own or are authorised to test. Become a Partner or Sponsor → Full disclaimer

CVE-2026-106501

critical

Backstage is an open framework for building developer portals.

Vendor / product: Linuxfoundation — backstage\/plugin-scaffolder-backend

Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by sensitive information exposure in scaffolder. An authenticated Backstage user who can read another user's Scaffolder task may receive internal execution data. In deployments where that data contains credentials for an external service, this may permit disclosure and unauthorized changes in that external service. This issue is fixed in versions 3.3.1, 3.4.1, 4.0.3 and 4.1.0.

CVSS
9.6
9.6 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Severity source: NVD CVSS v3.1 (security-advisories@github.com)
Timeline (UTC)
Published: 2026-10-06 22:17
Modified: 2026-10-13 14:38
NVD status: Analyzed
Last synced 2 days ago
Verified against the source API 2026-10-27 06:58 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).

Affected products

linuxfoundation / backstage\/plugin-scaffolder-backend <3.3.1, ≥3.4.0 <3.4.1, ≥4.0.0 <4.0.3, ≥4.0.4 <4.1.0
linuxfoundation / backstage <1.49.6, ≥1.50.0 <1.50.5, ≥1.51.0 <1.54.6

Weakness classification (CWE)

CWE-200 CWE-201

Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.

Mitigation & advisories

Vendor advisory: https://github.com/backstage/backstage/security/advisories/GHSA-g2v8-7jhw-pp8p
Patch / mitigation: https://github.com/backstage/backstage/commit/66d2219edf0abe33ab7d0c1ced5d069d1e065be5
Patch / mitigation: https://github.com/backstage/backstage/commit/c19838870476a8e29144c84b1a5ac0654ec20fb5
Patch / mitigation: https://github.com/backstage/backstage/commit/e262d649981ff99bb01ca7077807ae3e25e85560
Patch / mitigation: https://github.com/backstage/backstage/releases/tag/v1.49.6
Patch / mitigation: https://github.com/backstage/backstage/releases/tag/v1.50.5
Patch / mitigation: https://github.com/backstage/backstage/releases/tag/v1.54.6
Patch / mitigation: https://github.com/backstage/backstage/security/advisories/GHSA-g2v8-7jhw-pp8p

References

Data sources

NVD CVE API 2.0 — fetched 2026-10-27 06:58 UTC · record ↗

Learn the basics

Understanding CVEs and CVSS Scores

Related CVEs

CVE-2026-106456CVE-2026-106457CVE-2026-106458CVE-2026-106460CVE-2026-104252