CVE-2026-106499

Received Received - Intake

Secret Exposure in Backstage Scaffolder Backend

Publication date: 2026-10-06

Last updated on: 2026-10-06

Assigner: GitHub, Inc.

Description

Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package could expose secret-derived values in Scaffolder task logs. Deployments that configure sensitive scaffolder.defaultEnvironment.secrets and allow an attacker to create or modify Scaffolder templates are affected. A template author could cause secret-derived values used during template iteration to be persisted and exposed to users who can access the resulting task logs. This issue is fixed in version 4.1.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-06

Generated

2026-10-07

AI Q&A

2026-10-07

EPSS Evaluated

N/A

NVD

CVE-2026-106499

Affected Vendors & Products

Vendor	Product	Version / Range
backstage	backstage	< 1.54.6
@backstage	plugin-scaffolder-backend	< 4.1.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-532	The product writes sensitive information to a log file.

Attack-Flow Graph

Executive Summary

Backstage is an open framework for building developer portals. Prior to version 4.1.0, the @backstage/plugin-scaffolder-backend package could expose secret-derived values in Scaffolder task logs. This happens when sensitive secrets are configured in scaffolder.defaultEnvironment.secrets and an attacker can create or modify Scaffolder templates. The issue allows a template author to cause secret-derived values used during template iteration to be stored and exposed in task logs accessible to users.

Impact Analysis

If you use Backstage with the @backstage/plugin-scaffolder-backend package before version 4.1.0 and have sensitive secrets configured, an attacker with template modification access could expose those secrets in task logs. This could lead to unauthorized access to sensitive information like API keys or passwords.

Compliance Impact

This vulnerability could lead to unauthorized exposure of sensitive data, which may violate compliance requirements under GDPR (data protection) or HIPAA (health information privacy). Unauthorized access to secrets could result in data breaches, triggering regulatory penalties or fines.

Mitigation Strategies

Upgrade the @backstage/plugin-scaffolder-backend package to version 4.1.0 or later to address the issue.

Hi! I’m here to help you understand CVE-2026-106499. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70