CVE-2026-106499: Backstage: Secret-derived values may be exposed in scaffolder task logs
Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package could expose secret-derived values in Scaffolder task logs. Deployments that configure sensitive scaffolder.defaultEnvironment.secrets and allow an attacker to create or modify Scaffolder templates are affected. A template author could cause secret-derived values used during template iteration to be persisted and exposed to users who can access the resulting task logs. This issue is fixed in version 4.1.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
@backstage/plugin-scaffolder-backendto a version that resolves this vulnerability.Fixed in 4.1.0
Event History
Frequently Asked Questions
Which deployments are affected?
Affected deployments use sensitive values in scaffolder.defaultEnvironment.secrets and permit an attacker to create or modify Scaffolder templates. The issue applies to @backstage/plugin-scaffolder-backend versions prior to 4.1.0.
What level of access does an attacker need?
An attacker needs the ability to create or modify a Scaffolder template. They can then cause secret-derived values used during template iteration to be persisted in task logs.
Who could see exposed values?
Users who can access the resulting Scaffolder task logs may be able to view the persisted secret-derived values. The exposure is therefore dependent on both template-authoring access and task-log access.
What is the remediation?
Upgrade @backstage/plugin-scaffolder-backend to version 4.1.0. If an immediate upgrade is not possible, restrict who can create or modify Scaffolder templates and avoid configuring sensitive values in scaffolder.defaultEnvironment.secrets.