CVE-2026-106504

Analyzed Analyzed - Analysis Complete

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-13

Assigner: GitHub, Inc.

Description

Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by sensitive information exposure in scaffolder task logs. An authenticated user who can create and read scaffolder tasks may be able to observe sensitive values in task logs in deployments with restrictive action permissions and affected templates. Exploitation requires a denied action whose input contains such a value. This issue is fixed in version 4.1.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-13

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-106504

EUVD

EUVD-2026-94069

Affected Vendors & Products

Vendor	Product	Version / Range
linuxfoundation	backstage/plugin-scaffolder-backend	to 4.1.0 (exc)
linuxfoundation	backstage	to 1.54.6 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-532	The product writes sensitive information to a log file.

Attack-Flow Graph

Executive Summary

This vulnerability is a sensitive information exposure in Backstage's scaffolder task logs. It affects the @backstage/plugin-scaffolder-backend package before version 4.1.0. An authenticated user with task creation and read access could see sensitive values in logs, even in deployments with strict action permissions, if a denied action includes such values.

Detection Guidance

Check Backstage version with npm list @backstage/plugin-scaffolder-backend. If version is below 4.1.0, the system is vulnerable. Review scaffolder task logs for sensitive data exposure in denied actions.

Impact Analysis

If exploited, this vulnerability could allow unauthorized users to view sensitive data in task logs, potentially exposing credentials, API keys, or other confidential information. This could lead to data breaches or unauthorized access to systems.

Compliance Impact

This vulnerability could violate compliance requirements like GDPR or HIPAA by exposing sensitive personal or health data. Organizations may face legal penalties, reputational damage, and loss of trust if such data is leaked due to inadequate log protection.

Mitigation Strategies

Upgrade @backstage/plugin-scaffolder-backend to version 4.1.0 or later. Review and sanitize task logs to remove sensitive values. Implement stricter access controls for scaffolder tasks.

Hi! I’m here to help you understand CVE-2026-106504. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70