CVE-2026-106506: backstage

Vulnerability summary

CVE-2026-106506 is a medium (CVSS 5.3) vulnerability in backstage. EPSS estimates a 0.22% chance of exploitation in the next 30 days, higher than 11.4% of scored vulnerabilities.

Timeline

1. 06-10-2026
   PublishedVulnerability first disclosed.
2. 07-10-2026
   Last modifiedVulnerability information updated.

Description

Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by improper input validation in scaffolder task list ordering. An authenticated Backstage user with permission to create and read relevant scaffolder tasks may be able to infer confidential task data under specific conditions. Successful exploitation requires retained task secrets, visibility of a target task, knowledge of the secret structure, and repeated requests. This issue is fixed in version 4.1.0.

• CWE-202Exposure of Sensitive Information Through Data QueriesWhen trying to keep information confidential, an attacker can often infer some of the information by using statistics.
• CWE-203Observable DiscrepancyThe product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor.