CVE-2026-106499: Backstage: Secret-derived values may be exposed in scaffolder task logs
Impact
Deployments that configure sensitive scaffolder.defaultEnvironment.secrets and allow an attacker to create or modify Scaffolder templates are affected. A template author could cause secret-derived values used during template iteration to be persisted in task logs, exposing those values to users with access to the resulting task logs.
Patches
Patched in @backstage/plugin-scaffolder-backend version 4.1.0
Workarounds
- Restrict permission to create or update Template entities to fully trusted parties, as recommended by the Backstage threat model. - If that restriction cannot be guaranteed, remove sensitive values from scaffolder.defaultEnvironment.secrets until a patched version is available.
No complete workaround is known that preserves both untrusted template authoring and access to sensitive default-environment secrets.
Other sources
Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package could expose secret-derived values in Scaffolder task logs. Deployments that configure sensitive scaffolder.defaultEnvironment.secrets and allow an attacker to create or modify Scaffolder templates are affected. A template author could cause secret-derived values used during template iteration to be persisted and exposed to users who can access the resulting task logs. This issue is fixed in version 4.1.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/@backstage/plugin-scaffolder-backendto a version that resolves this vulnerability.Fixed in 4.1.0 - Upgrade
Upgrade
@backstage/plugin-scaffolder-backendto a version that resolves this vulnerability.Fixed in 4.1.0 - Configuration
Remove sensitive values from scaffolder.defaultEnvironment.secrets until version 4.1.0 is available.
Backstage Scaffolder scaffolder.defaultEnvironment.secrets = remove sensitive values - Compensating control
Restrict permission to create or update Template entities to fully trusted parties.
Event History
Frequently Asked Questions
Which deployments are affected?
Affected deployments use sensitive values in scaffolder.defaultEnvironment.secrets and permit an attacker to create or modify Scaffolder templates. The issue applies to @backstage/plugin-scaffolder-backend versions prior to 4.1.0.
What level of access does an attacker need?
An attacker needs the ability to create or modify a Scaffolder template. They can then cause secret-derived values used during template iteration to be persisted in task logs.
Who could see exposed values?
Users who can access the resulting Scaffolder task logs may be able to view the persisted secret-derived values. The exposure is therefore dependent on both template-authoring access and task-log access.
What is the remediation?
Upgrade @backstage/plugin-scaffolder-backend to version 4.1.0. If an immediate upgrade is not possible, restrict who can create or modify Scaffolder templates and avoid configuring sensitive values in scaffolder.defaultEnvironment.secrets.