Race Condition

Overview @backstage/plugin-scaffolder-backend is a The Backstage backend plugin that helps you create new things Affected versions of this package are vulnerable to Race Condition via the retryTask method in DatabaseTaskStore.ts, where a task retry operation is performed without first validating...

Backstage: Improper task state validation in Scaffolder backend

Impact An authenticated user with permission to create and access Scaffolder tasks may, under specific timing and deployment conditions, affect files accessible to the Backstage backend. If backend application files are writable, the confidentiality, integrity, and availability of the backend may...

EUVD-2026-94058

Backstage: Improper task state validation in Scaffolder backend...

Backstage: Incorrect authorization in scaffolder task listing

Impact An authenticated internal user may be able to view metadata for scaffolder tasks outside the visibility intended by a deployment's permission policy. Stored task secrets are not included in the affected response, and no integrity or availability impact was identified. Patches Patched in...

EUVD-2026-93996

Backstage: Incorrect authorization in scaffolder task listing...

Incorrect Authorization

Overview @backstage/plugin-scaffolder-backend is a The Backstage backend plugin that helps you create new things Affected versions of this package are vulnerable to Incorrect Authorization via the getAuthorizeConditions function in checkPermissions.ts, which fails to enforce DENY authorization...

CVE-2026-106487

A flaw was found in the plugin-kubernetes-backend component of Backstage. In environments configured for catalog cluster discovery, an authenticated catalog contributor can define an unsupported authentication mode on cluster resource entities. This vulnerability allows the backend to query the...

CVE-2026-106496

A flaw was found in the Backstage plugin-catalog-backend component. Due to inconsistent enforcement of allowed location types during catalog processing, an authenticated remote attacker can submit location targets that should be restricted under specific configurations. This flaw can enable the...

CVE-2026-106561

A flaw was found in the Backstage Kubernetes backend plugin plugin-kubernetes-backend. An authenticated user with standard resource read permissions can retrieve sensitive values from Kubernetes queries that the plugin is designed to mask. This flaw allows information disclosure, potentially...

CVE-2026-106502

A flaw was found in the Backstage plugin-scaffolder-backend component. Under specific template and failure conditions, Scaffolder task failure events can expose sensitive backend-managed credentials. An authenticated user can exploit this vulnerability to retrieve credentials used during task...

CVE-2026-106504

A flaw was found in plugin-scaffolder-backend. An authenticated user with permissions to create and read scaffolder tasks can observe sensitive values in task logs when an execution step is denied by action permissions. This flaw allows an attacker to access sensitive input data, resulting in...

CVE-2026-106461

A flaw was found in plugin-scaffolder-backend. An improper authorization flaw allows an authenticated user to view task metadata outside their intended permissions, resulting in unauthorized information disclosure. This vulnerability occurs during scaffolder task listing when deployment permissio...

CVE-2026-106497

A flaw was found in Backstage's plugin-catalog-backend component. Inconsistent evaluation of catalog property permissions can lead to unauthorized information disclosure. In environments that rely on value-based permission rules to enforce access controls, an authenticated attacker can bypass...

CVE-2026-106456

A flaw was found in the Backstage plugin-proxy-backend package. When overlapping proxy paths are configured with different authentication requirements, access exemptions permitted on a parent route can improperly extend to nested routes that require credentials. A remote, unauthenticated attacker...

CVE-2026-106503

A flaw was found in the Backstage plugin-scaffolder-backend component. An authorization bypass allows an authenticated user with access to Scaffolder templates to circumvent configured action restrictions. By manipulating action inputs, an attacker can leverage integration credentials to gain...

CVE-2026-106557

Backstage is an open framework for building developer portals. Prior to 1.14.6 and 1.15.4, the @backstage/plugin-techdocs-node package did not sufficiently validate TechDocs Markdown extension configuration. An authenticated user who can register or modify documentation sources may cause a TechDo...

Insertion of Sensitive Information into Log File

Overview @backstage/plugin-scaffolder-backend is a The Backstage backend plugin that helps you create new things Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File via the collectSecretRedactions function in NunjucksWorkflowRunner.ts, which fails ...

Backstage may expose sensitive information in Scaffolder task failure events

Impact Under specific template and failure conditions, an authenticated user may be able to retrieve sensitive values from Scaffolder task events. This can expose backend-managed credentials used during task execution. Patches Patched in @backstage/plugin-scaffolder-backend version 4.1.0...

EUVD-2026-94060

Backstage may expose sensitive information in Scaffolder task failure events...

Backstage has sensitive information exposure in scaffolder task logs

Impact An authenticated user who can create and read scaffolder tasks may be able to observe sensitive values in task logs in deployments with restrictive action permissions and affected templates. Exploitation requires a denied action whose input contains such a value. Patches Patched in...