CVE-2026-106502 Backstage: Sensitive information may be exposed in Scaffolder task failure events
Authenticated users can retrieve backend-managed credentials from Scaffolder task failure events in Backstage developer portals.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-106502?
CVE-2026-106502 is a medium-severity vulnerability in Linuxfoundation Backstage, published on 6 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package could expose sensitive information in Scaffolder task failure events. Under specific template and failure conditions, an authenticated user may retrieve backend-managed credentials used during task execution from affected task events. This issue is fixed in version 4.1.0.
Weakness: CWE-532
Which versions are affected by CVE-2026-106502?
2 open source packages ship an affected version, including @backstage/plugin-scaffolder-backend. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
@backstage/plugin-scaffolder-backend npm | All versions | 4.1.0 |
@backstage/plugin-scaffolder-backend npm | All versions | 4.1.0 |
Products include Linuxfoundation Backstage, Linuxfoundation Backstage\/Plugin-Scaffolder-Backend.
How do I fix CVE-2026-106502?
Upgrade @backstage/plugin-scaffolder-backend to 4.1.0 or later.
Is CVE-2026-106502 being exploited?
There is no known exploitation of CVE-2026-106502 in the wild and no public exploit code.
Other vulnerabilities in Linuxfoundation Backstage
- CVE-2026-106501 Backstage: Sensitive information exposure in Scaffolder
- CVE-2026-106558 Backstage: Improper validation of TechDocs MkDocs configuration
- CVE-2026-88064 Backstage: Improper input validation in TechDocs MkDocs configuration
- CVE-2026-106459 Backstage: Improper input validation in Sentry scaffolder actions
- CVE-2026-106486 Backstage: Improper filesystem validation in Bitbucket pull-request scaffolder actions
Sources
Also known as GHSA-95p4-vv4g-jxxm.