CVE-2026-106501: backstage
Vulnerability summary
CVE-2026-106501 is a critical (CVSS 9.6) vulnerability in backstage. EPSS estimates a 0.48% chance of exploitation in the next 30 days, higher than 40.2% of scored vulnerabilities.
Timeline
- 06-10-2026PublishedVulnerability first disclosed.
- 07-10-2026Last modifiedVulnerability information updated.
Description
Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by sensitive information exposure in scaffolder. An authenticated Backstage user who can read another user's Scaffolder task may receive internal execution data. In deployments where that data contains credentials for an external service, this may permit disclosure and unauthorized changes in that external service. This issue is fixed in versions 3.3.1, 3.4.1, 4.0.3 and 4.1.0.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · NpmEcosystem advisory · calculated9.6CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
- NVDNIST9.6CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
EPSS trend
Probability
0.48%
Chance of exploitation in the next 30 days
Percentile
40%
Versus all other CVEs
30-day change
Change unavailable
Change unavailable
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
- CWE-201Insertion of Sensitive Information Into Sent DataThe code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.
Affected systems
@backstage2 products
- plugin-scaffolder-backend< 3.3.1 | ≥ 3.4.0, < 3.4.1 | ≥ 4.0.0, < 4.0.3 | ≥ 4.0.4, < 4.1.0
- plugin-scaffolder-backend< 3.3.1 | ≥ 3.4.0, < 3.4.1 | ≥ 4.0.0, < 4.0.3 | ≥ 4.0.4, < 4.1.0
Linuxfoundation2 products
- backstage< 1.49.6 | ≥ 1.50.0, < 1.50.5 | ≥ 1.51.0, < 1.54.6
- backstage\/plugin-scaffolder-backend< 3.3.1 | ≥ 3.4.0, < 3.4.1 | ≥ 4.0.0, < 4.0.3 | ≥ 4.0.4, < 4.1.0
Backstage1 product
- backstage< 1.49.6 | ≥ 1.50.0-next.0, < 1.50.5 | ≥ 1.51.0-next.0, < 1.54.6
3 vendors · 5 products
References
9 links- github.com/backstage/backstage/security/advisories/GHSA-g2v8-7jhw-pp8pX Refsource CONFIRMWEBMitigationVendor Advisory
- github.com/backstage/backstage/commit/66d2219edf0abe33ab7d0c1ced5d069d1e065be5X Refsource MISCWEBPatch
- github.com/backstage/backstage/commit/c19838870476a8e29144c84b1a5ac0654ec20fb5X Refsource MISCWEBPatch
- github.com/backstage/backstage/commit/e262d649981ff99bb01ca7077807ae3e25e85560X Refsource MISCWEBPatch
