CVE-2026-106499

Description

Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package could expose secret-derived values in Scaffolder task logs. Deployments that configure sensitive scaffolder.defaultEnvironment.secrets and allow an attacker to create or modify Scaffolder templates are affected. A template author could cause secret-derived values used during template iteration to be persisted and exposed to users who can access the resulting task logs. This issue is fixed in version 4.1.0.

Traduire en français

Produits concernés

• backstage
• @backstage plugin-scaffolder-backend
• Linuxfoundation backstage\/plugin-scaffolder-backend
• Linuxfoundation backstage

Scores CVSS

Faiblesses (CWE)

• CWE-532

Références

• https://github.com/backstage/backstage/commit/dc30fae2d96cb1606d36cc40b242f9b9e539bd70 Patch
• https://github.com/backstage/backstage/releases/tag/v1.54.6 PatchRelease Notes
• https://github.com/backstage/backstage/security/advisories/GHSA-mfvq-x7vr-rgqg MitigationVendor Advisory

Ailleurs

• NVD
• CVE.org
• CIRCL Vulnerability-Lookup
• CERT-FR
• GitHub Advisories