CVE-2026-106501

{
  "etk_id": "ETK-2026-816",
  "cve_id": "CVE-2026-106501",
  "display_id": "CVE-2026-106501",
  "ghsa_id": "GHSA-g2v8-7jhw-pp8p",
  "euvd_id": "EUVD-2026-94059",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Sensitive information exposure in Backstage Scaffolder",
  "summary": "Affected versions of @backstage/plugin-scaffolder-backend can expose internal Scaffolder task execution data to authenticated users who can read other users' tasks. If that data includes external-service credentials, an attacker may disclose them and use them to make unauthorized changes in the associated service.",
  "mitigation": "Upgrade @backstage/plugin-scaffolder-backend to 3.3.1, 3.4.1, 4.0.3, or 4.1.0, as appropriate for your release line. Until upgraded, configure scaffolder.task.read with the isTaskOwner condition and limit affected integrations and workflows to trusted operators.",
  "vendor": "backstage",
  "product": "backstage",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "< 3.3.1"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "3.3.1"
      ],
      "package_name": "@backstage/plugin-scaffolder-backend",
      "purl": "pkg:npm/@backstage/plugin-scaffolder-backend"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 3.4.0, < 3.4.1"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "3.4.1"
      ],
      "package_name": "@backstage/plugin-scaffolder-backend",
      "purl": "pkg:npm/@backstage/plugin-scaffolder-backend"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 4.0.0, < 4.0.3"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "4.0.3"
      ],
      "package_name": "@backstage/plugin-scaffolder-backend",
      "purl": "pkg:npm/@backstage/plugin-scaffolder-backend"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 4.0.4, < 4.1.0"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "4.1.0"
      ],
      "package_name": "@backstage/plugin-scaffolder-backend",
      "purl": "pkg:npm/@backstage/plugin-scaffolder-backend"
    }
  ],
  "cwes": [
    200
  ],
  "cvss_score": 9.6,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
  "epss_score": 0.0048,
  "epss_percentile": 0.4036,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 90.6983205,
  "t0_at": "2026-10-06T21:32:25.997000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-06T21:32:25.997000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-06T21:32:25.997000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-106501"
    }
  }
}