---
id: CVE-2026-106501
title: Backstage is an open framework for building developer portals
summary: >-
  Backstage is an open framework for building developer portals. Prior to 3.3.1,
  3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is
  affected by sensitive information exposure in scaffolder. An authenticated
  Backsta…
severity: critical
cvss: 9.6
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N'
cwe:
  - CWE-200
  - CWE-201
vendor: linuxfoundation
product: backstage/plugin-scaffolder-backend
affected:
  - backstage/plugin-scaffolder-backend < 3.3.1
  - 'backstage/plugin-scaffolder-backend >= 3.4.0, < 3.4.1'
  - 'backstage/plugin-scaffolder-backend >= 4.0.0, < 4.0.3'
  - 'backstage/plugin-scaffolder-backend >= 4.0.4, < 4.1.0'
  - backstage < 1.49.6
  - 'backstage >= 1.50.0, < 1.50.5'
  - 'backstage >= 1.51.0, < 1.54.6'
patched:
  - backstage/plugin-scaffolder-backend 4.1.0
  - backstage 1.54.6
published: '2026-10-06'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T14:38:15.587'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-106501'
references:
  - url: >-
      https://github.com/backstage/backstage/commit/66d2219edf0abe33ab7d0c1ced5d069d1e065be5
    label: security-advisories@github.com
  - url: >-
      https://github.com/backstage/backstage/commit/c19838870476a8e29144c84b1a5ac0654ec20fb5
    label: security-advisories@github.com
  - url: >-
      https://github.com/backstage/backstage/commit/e262d649981ff99bb01ca7077807ae3e25e85560
    label: security-advisories@github.com
  - url: 'https://github.com/backstage/backstage/releases/tag/v1.49.6'
    label: security-advisories@github.com
  - url: 'https://github.com/backstage/backstage/releases/tag/v1.50.5'
    label: security-advisories@github.com
  - url: 'https://github.com/backstage/backstage/releases/tag/v1.54.6'
    label: security-advisories@github.com
  - url: >-
      https://github.com/backstage/backstage/security/advisories/GHSA-g2v8-7jhw-pp8p
    label: security-advisories@github.com
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106501.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-106501'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2547222'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-106501'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-106501'
  - url: 'https://github.com/advisories/GHSA-g2v8-7jhw-pp8p'
  - url: 'https://access.redhat.com/errata/RHSA-2026:86675'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
  - ghsa
  - npm
epss: 0.00484
epssPercentile: 0.41477
aliases:
  - GHSA-g2v8-7jhw-pp8p
ecosystem: npm
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-07T15:30:59.165626Z'
scores:
  nvd: 9.6
  vendor: 8.1
  ghsa: 9.6
ingestedAt: '2026-10-06T22:23:15.967Z'
---

## Overview

Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by sensitive information exposure in scaffolder. An authenticated Backstage user who can read another user's Scaffolder task may receive internal execution data. In deployments where that data contains credentials for an external service, this may permit disclosure and unauthorized changes in that external service. This issue is fixed in versions 3.3.1, 3.4.1, 4.0.3 and 4.1.0.

## Affected

- `backstage/plugin-scaffolder-backend < 3.3.1`
- `backstage/plugin-scaffolder-backend >= 3.4.0, < 3.4.1`
- `backstage/plugin-scaffolder-backend >= 4.0.0, < 4.0.3`
- `backstage/plugin-scaffolder-backend >= 4.0.4, < 4.1.0`
- `backstage < 1.49.6`
- `backstage >= 1.50.0, < 1.50.5`
- `backstage >= 1.51.0, < 1.54.6`

## Remediation

Upgrade past the affected range:

- `backstage/plugin-scaffolder-backend 4.1.0`
- `backstage 1.54.6`

## Package advisory (CVE-2026-106501)

Affected packages:

- `@backstage/plugin-scaffolder-backend < 3.3.1`
- `@backstage/plugin-scaffolder-backend >= 3.4.0, < 3.4.1`
- `@backstage/plugin-scaffolder-backend >= 4.0.0, < 4.0.3`
- `@backstage/plugin-scaffolder-backend >= 4.0.4, < 4.1.0`

Patched in:

- `@backstage/plugin-scaffolder-backend 3.3.1`
- `@backstage/plugin-scaffolder-backend 3.4.1`
- `@backstage/plugin-scaffolder-backend 4.0.3`
- `@backstage/plugin-scaffolder-backend 4.1.0`

Source: https://github.com/advisories/GHSA-g2v8-7jhw-pp8p

## Vendor advisories

- **Red Hat VEX** · Important · affected: Red Hat Developer Hub, Self-service automation portal 2 · no fix planned: Red Hat Developer Hub, Self-service automation portal 2 · updated 2026-10-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106501.json)
- **RHSA-2026:86675** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.2 · released 2026-10-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:86675)