CVE-2026-106499 Backstage: Secret-derived values may be exposed in scaffolder task logs

What is CVE-2026-106499?

CVE-2026-106499 is a medium-severity vulnerability in Linuxfoundation Backstage, published on 6 Oct 2026.

Official description

Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package could expose secret-derived values in Scaffolder task logs. Deployments that configure sensitive scaffolder.defaultEnvironment.secrets and allow an attacker to create or modify Scaffolder templates are affected. A template author could cause secret-derived values used during template iteration to be persisted and exposed to users who can access the resulting task logs. This issue is fixed in version 4.1.0.

Weakness: CWE-532

Which versions are affected by CVE-2026-106499?

2 open source packages ship an affected version, including @backstage/plugin-scaffolder-backend. It affects 2 products.

Products include Linuxfoundation Backstage, Linuxfoundation Backstage\/Plugin-Scaffolder-Backend.

How do I fix CVE-2026-106499?

Upgrade @backstage/plugin-scaffolder-backend to 4.1.0 or later.

Is CVE-2026-106499 being exploited?

There is no known exploitation of CVE-2026-106499 in the wild and no public exploit code.

Other vulnerabilities in Linuxfoundation Backstage

• CVE-2026-106501 Backstage: Sensitive information exposure in Scaffolder Critical 9.6
• CVE-2026-106558 Backstage: Improper validation of TechDocs MkDocs configuration High 8.8
• CVE-2026-88064 Backstage: Improper input validation in TechDocs MkDocs configuration High 8.8
• CVE-2026-106459 Backstage: Improper input validation in Sentry scaffolder actions High 8.5
• CVE-2026-106486 Backstage: Improper filesystem validation in Bitbucket pull-request scaffolder actions High 8.5

All Linuxfoundation Backstage vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-mfvq-x7vr-rgqg.