Résumé
Backstage may expose sensitive information in Scaffolder task failure events
Détails de l’avis
Impact
Under specific template and failure conditions, an authenticated user may be able to retrieve sensitive values from Scaffolder task events. This can expose backend-managed credentials used during task execution.
Patches
Patched in @backstage/plugin-scaffolder-backend version 4.1.0
Workarounds
- Restrict Scaffolder template execution and task-event access to trusted users until the patched version is deployed.
Références
- https://github.com/advisories/GHSA-95p4-vv4g-jxxm
- https://github.com/backstage/backstage/security/advisories/GHSA-95p4-vv4g-jxxm
- https://nvd.nist.gov/vuln/detail/CVE-2026-106502
- https://github.com/backstage/backstage/commit/3f1e869708f002fb9838624b7379deb251691b47
- https://github.com/backstage/backstage/releases/tag/v1.54.6
Vulnérabilités liées
Tout Supply chain →- MEDIUMCVE-2026-106499
Backstage: Secret-derived values may be exposed in scaffolder task logs
- MEDIUMCVE-2026-106504
Backstage has sensitive information exposure in scaffolder task logs
- MEDIUMCVE-2026-86597
Snowflake drivers writes sensitive information to logs
- MEDIUMCVE-2026-104872
Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute
- HIGHGHSA-v853-p72q-4cfw
Quart leaks raw request body (incl. plaintext passwords) to stdout via stray debug print in Body.__await__
- MEDIUMGHSA-fj2x-mqqp-3v2w
Trigger.dev: Trigger CLI debug deployment logs expose resolved environment secret values