CVE-2026-106502: @backstage/plugin-scaffolder-backend Sensitive Information Exposure in Task Events
Summary
CVE-2026-106502: Backstage may expose sensitive information in Scaffolder task failure events. Affects @backstage/plugin-scaffolder-backend versions < 4.1.0. Fixed in 4.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The @backstage/plugin-scaffolder-backend package is a part of the Backstage framework, which is designed to streamline software development processes by providing scaffolding capabilities. It allows developers to create and manage templates for various tasks, enhancing productivity and consistency in software projects. However, this package has a vulnerability that can lead to the exposure of sensitive information during task execution failures.
Vulnerability Detail
The vulnerability arises when specific templates fail during execution, allowing authenticated users to access sensitive values from Scaffolder task events. This can include backend-managed credentials that are crucial for task execution, potentially leading to unauthorized access or data breaches. The issue is classified under CWE-532, which pertains to the exposure of sensitive information.
How To Fix
Latest published version: 4.2.1 as of 22 Oct 2026
npm install @backstage/plugin-scaffolder-backend@4.2.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.1.0
This is the first release that contains the fix.
npm install @backstage/plugin-scaffolder-backend@4.1.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, restrict Scaffolder template execution and task-event access to trusted users until the patched version is deployed. This can be done by adjusting user permissions in your Backstage configuration.
Conclusion
In summary, CVE-2026-106502 is a vulnerability in the @backstage/plugin-scaffolder-backend package that can lead to the exposure of sensitive information during task failures. It is crucial to update to version 4.1.0 or later to mitigate this risk. Until then, restricting access to sensitive task events is recommended.
See every vulnerability recorded for @backstage/plugin-scaffolder-backend →
FAQ
CVE-2026-106502 is a vulnerability in the @backstage/plugin-scaffolder-backend package that allows authenticated users to access sensitive information from task failure events.
If your application uses the affected version of the @backstage/plugin-scaffolder-backend package, it may expose sensitive backend-managed credentials during task execution failures.
As a workaround, restrict access to Scaffolder template execution and task-event data to trusted users until you can update to the patched version.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 5.3, indicating a moderate level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for @backstage/plugin-scaffolder-backend.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
