Summary
Backstage: Sensitive information exposure in Scaffolder
Advisory details
Impact
An authenticated Backstage user who can read another user's Scaffolder task may receive internal execution data. In deployments where that data contains credentials for an external service, this may permit disclosure and unauthorized changes in that external service.
Patches
Patched in @backstage/plugin-scaffolder-backend version 4.1.0
Workarounds
- Configure
scaffolder.task.readwith theisTaskOwnercondition so users can only read tasks they created. - Restrict affected integrations and workflows to trusted operators until an upgrade is available.
References
- https://github.com/advisories/GHSA-g2v8-7jhw-pp8p
- https://github.com/backstage/backstage/security/advisories/GHSA-g2v8-7jhw-pp8p
- https://nvd.nist.gov/vuln/detail/CVE-2026-106501
- https://github.com/backstage/backstage/commit/66d2219edf0abe33ab7d0c1ced5d069d1e065be5
- https://github.com/backstage/backstage/commit/c19838870476a8e29144c84b1a5ac0654ec20fb5
- https://github.com/backstage/backstage/commit/e262d649981ff99bb01ca7077807ae3e25e85560
- https://github.com/backstage/backstage/releases/tag/v1.49.6
- https://github.com/backstage/backstage/releases/tag/v1.50.5
Related vulnerabilities
All Supply chain →- HIGHCVE-2026-55553
urllib's cross-origin redirects preserve credential-bearing request headers, leading to potential credential leakage
- MEDIUMCVE-2026-66822
Microsoft Security Advisory CVE-2026-66822 - .NET and Visual Studio Information Disclosure Vulnerability
- MEDIUMGHSA-8wvg-r2j4-3737
Vikunja: Assignee email addresses disclosed to read-only project members via the task assignees endpoint
- MEDIUMGHSA-3hc7-r24j-rpwc
Vikunja: Cross-project task disclosure through subtask expansion
- MEDIUMCVE-2026-107842
Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled
- MEDIUMCVE-2026-91981
Vikunja: Link-share token can enumerate users through the v2 API