- Critical 9.6
CVE-2026-106501
Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by sensitive information exposure in scaffolder. An authenticated Backstage user who can read another user's Scaffolder task may receive internal execution data. In deployments where that data contains credentials for an external service, this may permit disclosure and unauthorized changes in that external service. This issue is fixed in versions 3.3.1, 3.4.1, 4.0.3 and 4.1.0.
Scores
The facts
- Published
- 6 October 2026
- Last changed
- 13 October 2026
- NVD status
- Analyzed
- Severity
- Critical, CVSS 9.6 out of 10 (version 3.1)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N - Weakness
- Affects
- linuxfoundation backstage
- Known exploited
- Not in the CISA Known Exploited Vulnerabilities catalogue in this build.
- EPSS
- 0.5% chance of exploitation activity in the next 30 days (percentile 40).
Is there a Securelyn advisory?
Not yet. Securelyn writes plain-English advisories for the flaws that matter most to businesses. Subscribe to the digest to hear about them.