[ CVE-2026-106506 · Published 6 Oct 2026 ]
Backstage has improper input validation in scaffolder task list ordering
CVSS 5.3
EPSS <1%Fix available
[ Description ]Official description
Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by improper input validation in scaffolder task list ordering. An authenticated Backstage user with permission to create and read relevant scaffolder tasks may be able to infer confidential task data under specific conditions. Successful exploitation requires retained task secrets, visibility of a target task, knowledge of the secret structure, and repeated requests. This issue is fixed in version 4.1.0.
[ Fixes ]Fixes and patches
- @backstage/plugin-scaffolder-backend 4.1.0Fixed version · GitHub Advisories · npm package @backstage/plugin-scaffolder-backend: upgrade to 4.1.0 or later (affected < 4.1.0)
- Patch on github.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD
- Patch on github.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD
[ Packages ]Affected open-source packages
- @backstage/plugin-scaffolder-backend npmAffected < 4.1.0 · fixed in 4.1.0 · GHSA-vwp5-f99x-x3rq