Summary
Backstage has sensitive information exposure in scaffolder task logs
Advisory details
Impact
An authenticated user who can create and read scaffolder tasks may be able to observe sensitive values in task logs in deployments with restrictive action permissions and affected templates. Exploitation requires a denied action whose input contains such a value.
Patches
Patched in @backstage/plugin-scaffolder-backend version 4.1.0
Workarounds
- Restrict scaffolder task creation and task-log reading to trusted users.
- Avoid placing centrally managed sensitive values in inputs to actions that may be denied until upgrading.
References
References
- https://github.com/advisories/GHSA-4xvq-3m68-h444
- https://github.com/backstage/backstage/security/advisories/GHSA-4xvq-3m68-h444
- https://nvd.nist.gov/vuln/detail/CVE-2026-106504
- https://github.com/backstage/backstage/commit/3eb3dc59eb0da0deccd532f19eb460bb452c9efb
- https://github.com/backstage/backstage/releases/tag/v1.54.6
Related vulnerabilities
All Supply chain →- MEDIUMCVE-2026-106499
Backstage: Secret-derived values may be exposed in scaffolder task logs
- MEDIUMCVE-2026-106502
Backstage may expose sensitive information in Scaffolder task failure events
- MEDIUMCVE-2026-86597
Snowflake drivers writes sensitive information to logs
- MEDIUMCVE-2026-104872
Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute
- HIGHGHSA-v853-p72q-4cfw
Quart leaks raw request body (incl. plaintext passwords) to stdout via stray debug print in Body.__await__
- MEDIUMGHSA-fj2x-mqqp-3v2w
Trigger.dev: Trigger CLI debug deployment logs expose resolved environment secret values