CVE-2026-106504 Backstage: Sensitive information exposure in scaffolder task logs

Medium 6.5 Published 6 Oct 2026 Updated 7 Oct 2026

Authenticated users may view sensitive data in scaffolder task logs if specific templates and restrictive permissions are configured.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-106504?

CVE-2026-106504 is a medium-severity vulnerability in Linuxfoundation Backstage, published on 6 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by sensitive information exposure in scaffolder task logs. An authenticated user who can create and read scaffolder tasks may be able to observe sensitive values in task logs in deployments with restrictive action permissions and affected templates. Exploitation requires a denied action whose input contains such a value. This issue is fixed in version 4.1.0.

Weakness: CWE-532

Which versions are affected by CVE-2026-106504?

2 open source packages ship an affected version, including @backstage/plugin-scaffolder-backend. It affects 2 products.

Package	Affected	Fixed in
`@backstage/plugin-scaffolder-backend` npm	All versions	`4.1.0`
`@backstage/plugin-scaffolder-backend` npm	All versions	`4.1.0`

Products include Linuxfoundation Backstage, Linuxfoundation Backstage\/Plugin-Scaffolder-Backend.

How do I fix CVE-2026-106504?

Upgrade @backstage/plugin-scaffolder-backend to 4.1.0 or later.

Is CVE-2026-106504 being exploited?

There is no known exploitation of CVE-2026-106504 in the wild and no public exploit code.

All Linuxfoundation Backstage vulnerabilities

Sources

Also known as GHSA-4xvq-3m68-h444.