CVE-2026-106499: Backstage Scaffolder Backend secret exposure in task logs

CVE-2026-106499 · Severity: medium · CVSS 4.9 · Published 2026-10-06

Backstage is an open-source framework that enables organizations to build custom developer portals for internal service discovery and infrastructure management. In versions before 4.1.0, a flaw in the Scaffolder plugin could cause secret values configured in templates to be written to task execution logs, potentially exposing credentials to users with log access. An attacker with the ability to create or modify Scaffolder templates could deliberately trigger this behavior.

Technologies: @backstage/plugin-scaffolder-backend (npm), Spotify Backstage. Vendors: npm, Spotify.

Quick answers

Is CVE-2026-106499 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-106499 being exploited in the wild.
How severe is CVE-2026-106499?
Medium severity, with a CVSS score of 4.9, published 6 October 2026.
Which products and versions are affected?
@backstage/plugin-scaffolder-backend (npm) < 4.1.0, SEMVER:introduced=0,fixed=4.1.0; Spotify Backstage prior to 4.1.0.
Is there a fix for CVE-2026-106499?
Yes. @backstage/plugin-scaffolder-backend (npm): upgrade to 4.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-106499 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-106499?
Check whether you run @backstage/plugin-scaffolder-backend (npm) or Spotify Backstage at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @backstage/plugin-scaffolder-backend (npm): upgrade to 4.1.0 or later
    npm install @backstage/plugin-scaffolder-backend@4.1.0

Technical details

The @backstage/plugin-scaffolder-backend package fails to properly redact transformed secret values that are interpolated into Scaffolder template steps. An authenticated template author can craft a template that uses secret-derived values during iteration, causing those secrets to be persisted in task logs accessible to unauthorized users. The vulnerability requires an attacker to have the ability to create or modify Scaffolder templates and for the deployment to have configured sensitive values in scaffolder.defaultEnvironment.secrets.

Affected products

  • Spotify Backstage prior to 4.1.0

Identifiers

  • CVE-2026-106499
  • GHSA-mfvq-x7vr-rgqg

Timeline

  • 2026-10-06: disclosed
  • 2026-08-27: patched: Fix committed to repository

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.