Backstage: Sensitive information exposure in Scaffolder

🗓️ 07 Oct 2026 17:59:19Reported by GitHub Advisory DatabaseType

github🔗 github.com👁 8 Views

Authenticated users can experience sensitive information exposure in Scaffolder tasks.

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2026-106501	7 Oct 202600:10	–	circl
CVE	CVE-2026-106501	6 Oct 202621:32	–	cve
Cvelist	CVE-2026-106501 Backstage: Sensitive information exposure in Scaffolder	6 Oct 202621:32	–	cvelist
EUVD	EUVD-2026-94059	7 Oct 202617:59	–	euvd
Mend	CVE-2026-106501	6 Oct 202621:32	–	mend
NVD	CVE-2026-106501	6 Oct 202622:17	–	nvd
OSV	GHSA-G2V8-7JHW-PP8P Backstage: Sensitive information exposure in Scaffolder	7 Oct 202617:59	–	osv
Positive Technologies	PT-2026-107298	6 Oct 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-106501	7 Oct 202605:25	–	redhatcve
Vulnrichment	CVE-2026-106501 Backstage: Sensitive information exposure in Scaffolder	6 Oct 202621:32	–	vulnrichment

Vulners

Node

OR

backstage plugin-scaffolder-backendRange4.0.4–4.1.0npm

backstage plugin-scaffolder-backendRange4.0.0–4.0.3npm

backstage plugin-scaffolder-backendRange3.4.0–3.4.1npm

backstage plugin-scaffolder-backendRange<3.3.1npm

Source	Link
github	www.github.com/backstage/backstage/security/advisories/GHSA-g2v8-7jhw-pp8p
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-106501
github	www.github.com/backstage/backstage/commit/66d2219edf0abe33ab7d0c1ced5d069d1e065be5
github	www.github.com/backstage/backstage/commit/c19838870476a8e29144c84b1a5ac0654ec20fb5
github	www.github.com/backstage/backstage/commit/e262d649981ff99bb01ca7077807ae3e25e85560
github	www.github.com/backstage/backstage/releases/tag/v1.49.6
github	www.github.com/backstage/backstage/releases/tag/v1.50.5
github	www.github.com/backstage/backstage/releases/tag/v1.54.6
github	www.github.com/advisories/GHSA-g2v8-7jhw-pp8p

07 Oct 2026 17:59Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.19.6

EPSS0.00473

SSVC

CWE-200 CWE-201

Backstage Scaffolder sensitive information exposure