ZeroDay Findings
Sign inSign up

Findings

CVE-2026-106499

Backstage is an open framework for building developer portals.

Published Oct 6, 2026 · updated Oct 15, 2026 · linuxfoundation backstage/plugin-scaffolder-backend

Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package could expose secret-derived values in Scaffolder task logs. Deployments that configure sensitive scaffolder.defaultEnvironment.secrets and allow an attacker to create or modify Scaffolder templates are affected. A template author could cause secret-derived values used during template iteration to be persisted and exposed to users who can access the resulting task logs. This issue is fixed in version 4.1.0.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 6, 2026 · NIST NVD

    Detected

    Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package could expose secret-derived values in Scaffolder task logs. Deployments that configure sensitive scaffolder.defaultEnvironment.secrets and allow an attacker to create or modify Scaffolder templates are affected. A template author could cause secret-derived values used dur

  2. Oct 15, 2026 · NIST NVD

    Updated

    Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package could expose secret-derived values in Scaffolder task logs. Deployments that configure sensitive scaffolder.defaultEnvironment.secrets and allow an attacker to create or modify Scaffolder templates are affected. A template author could cause secret-derived values used dur

Affected

  • cpe linuxfoundation/backstageversion unspecified
  • cpe linuxfoundation/backstage/plugin-scaffolder-backendversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-106499

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-106499

    30-day exploitation probability 0.3%

    first.org
  • NIST NVDVulnerability recordCVE-2026-106499

    Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package could expose secret-derived values in Scaffolder task logs. Deployments that configure sensitive scaffolder.defaultEnvironment.secrets and allow an atta

    nvd.nist.gov

References