CVE-2026-106501: linuxfoundation backstage\/plugin-scaffolder-backend, linuxfoundation backstage

CVSS 9.6 (critical) · published 2026-10-06

Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by sensitive information exposure in scaffolder. An authenticated Backstage user who can read another user's Scaffolder task may receive internal execution data. In deployments where that data contains credentials for an external service, this may permit disclosure and unauthorized changes in that external service. This issue is fixed in versions 3.3.1, 3.4.1, 4.0.3 and 4.1.0.

Affected products (NVD): linuxfoundation backstage\/plugin-scaffolder-backend, linuxfoundation backstage

Fixed in (NVD): 3.3.1, 3.4.1, 4.0.3, 4.1.0, 1.49.6, 1.50.5, 1.54.6

Weakness: CWE-200, CWE-201

Source: NVD CVE-2026-106501

References

• https://github.com/backstage/backstage/commit/66d2219edf0abe33ab7d0c1ced5d069d1e065be5
• https://github.com/backstage/backstage/commit/c19838870476a8e29144c84b1a5ac0654ec20fb5
• https://github.com/backstage/backstage/commit/e262d649981ff99bb01ca7077807ae3e25e85560
• https://github.com/backstage/backstage/releases/tag/v1.49.6
• https://github.com/backstage/backstage/releases/tag/v1.50.5
• https://github.com/backstage/backstage/releases/tag/v1.54.6
• https://github.com/backstage/backstage/security/advisories/GHSA-g2v8-7jhw-pp8p

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.