CVE-2026-106501: Backstage: Sensitive information exposure in Scaffolder

The Scaffolder runs software templates, and each run is a task. A task carries internal execution data. In affected versions, a user who is allowed to read someone else's task receives that data. The advisory does not list the fields. It says that where the data contains credentials for an external service, the reader may gain disclosure of, and make unauthorized changes in, that service.

The attacker needs a Backstage login and permission to read other users' tasks. By default, any signed-in user may have that, depending on your permission policy. Think of a template that takes a token for a Git host, cloud account or registry. Another employee who can open the task could pick up that token and act on that service with its rights, which reaches well past Backstage itself. That explains the changed-scope vector and the 9.6 score.

If your policy already limits task reads to the task's creator, exposure is much lower.

Affected: npm package @backstage/plugin-scaffolder-backend below 3.3.1, 3.4.0 only (fixed in 3.4.1), 4.0.0 to 4.0.2 (fixed in 4.0.3), and 4.0.4 only (fixed in 4.1.0). Check:

npm ls @backstage/plugin-scaffolder-backend

Then look at your permission policy for scaffolder.task.read. If it lets users read tasks they did not create, you are exposed.

Upgrade @backstage/plugin-scaffolder-backend to the patched version for your line: 3.3.1, 3.4.1, 4.0.3, or 4.1.0.

yarn up @backstage/plugin-scaffolder-backend

The fix shipped in Backstage releases 1.49.6, 1.50.5 and 1.54.6. Workarounds from the advisory: configure scaffolder.task.read with the isTaskOwner condition so users read only tasks they created, and restrict affected integrations and workflows to trusted operators. After upgrading, rotate credentials that templates passed through tasks.

Look in Backstage backend logs for task read requests where the requester differs from the task creator. Check which external-service credentials your templates handle, then review those services' audit logs for unusual use from unexpected addresses or accounts. The advisory names no log strings.

Impact

An authenticated Backstage user who can read another user's Scaffolder task may receive internal execution data. In deployments where that data contains credentials for an external service, this may permit disclosure and unauthorized changes in that external service.

Patches

Patched in @backstage/plugin-scaffolder-backend version 4.1.0

Workarounds

• Configure scaffolder.task.read with the isTaskOwner condition so users can only read tasks they created.
• Restrict affected integrations and workflows to trusted operators until an upgrade is available.