~ / search / GHSA-95p4-vv4g-jxxm

GHSA-95p4-vv4g-jxxm

Backstage may expose sensitive information in Scaffolder task failure events

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-106502

Packages

EcosystemPackageAffectedFixed in
npm @backstage/plugin-scaffolder-backend < 4.1.0 4.1.0

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact Under specific template and failure conditions, an authenticated user may be able to retrieve sensitive values from Scaffolder task events. This can expose backend-managed credentials used during task execution. ### Patches Patched in `@backstage/plugin-scaffolder-backend` version `4.1.0` ### Workarounds - Restrict Scaffolder template execution and task-event access to trusted users until the patched version is deployed.

References

External links from the advisory. They lead to third-party sites.