{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-106501", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-10-06T18:46:47.766Z", "datePublished": "2026-10-06T21:32:25.997Z", "dateUpdated": "2026-10-06T21:32:25.997Z"}, "containers": {"cna": {"title": "Backstage: Sensitive information exposure in Scaffolder", "problemTypes": [{"descriptions": [{"cweId": "CWE-200", "lang": "en", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-201", "lang": "en", "description": "CWE-201: Insertion of Sensitive Information Into Sent Data", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.6, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/backstage/backstage/security/advisories/GHSA-g2v8-7jhw-pp8p", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/backstage/backstage/security/advisories/GHSA-g2v8-7jhw-pp8p"}, {"name": "https://github.com/backstage/backstage/commit/66d2219edf0abe33ab7d0c1ced5d069d1e065be5", "tags": ["x_refsource_MISC"], "url": "https://github.com/backstage/backstage/commit/66d2219edf0abe33ab7d0c1ced5d069d1e065be5"}, {"name": "https://github.com/backstage/backstage/commit/c19838870476a8e29144c84b1a5ac0654ec20fb5", "tags": ["x_refsource_MISC"], "url": "https://github.com/backstage/backstage/commit/c19838870476a8e29144c84b1a5ac0654ec20fb5"}, {"name": "https://github.com/backstage/backstage/commit/e262d649981ff99bb01ca7077807ae3e25e85560", "tags": ["x_refsource_MISC"], "url": "https://github.com/backstage/backstage/commit/e262d649981ff99bb01ca7077807ae3e25e85560"}, {"name": "https://github.com/backstage/backstage/releases/tag/v1.49.6", "tags": ["x_refsource_MISC"], "url": "https://github.com/backstage/backstage/releases/tag/v1.49.6"}, {"name": "https://github.com/backstage/backstage/releases/tag/v1.50.5", "tags": ["x_refsource_MISC"], "url": "https://github.com/backstage/backstage/releases/tag/v1.50.5"}, {"name": "https://github.com/backstage/backstage/releases/tag/v1.54.6", "tags": ["x_refsource_MISC"], "url": "https://github.com/backstage/backstage/releases/tag/v1.54.6"}], "affected": [{"vendor": "backstage", "product": "backstage", "versions": [{"version": "< 1.49.6", "status": "affected"}, {"version": ">= 1.50.0-next.0, < 1.50.5", "status": "affected"}, {"version": ">= 1.51.0-next.0, < 1.54.6", "status": "affected"}]}, {"vendor": "@backstage", "product": "plugin-scaffolder-backend", "versions": [{"version": "< 3.3.1", "status": "affected"}, {"version": ">= 3.4.0, < 3.4.1", "status": "affected"}, {"version": ">= 4.0.0, < 4.0.3", "status": "affected"}, {"version": ">= 4.0.4, < 4.1.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-06T21:32:25.997Z"}, "descriptions": [{"lang": "en", "value": "Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by sensitive information exposure in scaffolder. An authenticated Backstage user who can read another user's Scaffolder task may receive internal execution data. In deployments where that data contains credentials for an external service, this may permit disclosure and unauthorized changes in that external service. This issue is fixed in versions 3.3.1, 3.4.1, 4.0.3 and 4.1.0."}], "source": {"advisory": "GHSA-g2v8-7jhw-pp8p", "discovery": "UNKNOWN"}}}}

{}

{"affected": [{"affectedData": [{"product": "backstage", "vendor": "backstage", "versions": [{"status": "affected", "version": "< 1.49.6"}, {"status": "affected", "version": ">= 1.50.0-next.0, < 1.50.5"}, {"status": "affected", "version": ">= 1.51.0-next.0, < 1.54.6"}]}, {"product": "plugin-scaffolder-backend", "vendor": "@backstage", "versions": [{"status": "affected", "version": "< 3.3.1"}, {"status": "affected", "version": ">= 3.4.0, < 3.4.1"}, {"status": "affected", "version": ">= 4.0.0, < 4.0.3"}, {"status": "affected", "version": ">= 4.0.4, < 4.1.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by sensitive information exposure in scaffolder. An authenticated Backstage user who can read another user's Scaffolder task may receive internal execution data. In deployments where that data contains credentials for an external service, this may permit disclosure and unauthorized changes in that external service. This issue is fixed in versions 3.3.1, 3.4.1, 4.0.3 and 4.1.0."}], "id": "CVE-2026-106501", "lastModified": "2026-10-06T22:17:05.217", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.6, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 5.8, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2026-10-06T22:17:05.217", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/backstage/backstage/commit/66d2219edf0abe33ab7d0c1ced5d069d1e065be5"}, {"source": "security-advisories@github.com", "url": "https://github.com/backstage/backstage/commit/c19838870476a8e29144c84b1a5ac0654ec20fb5"}, {"source": "security-advisories@github.com", "url": "https://github.com/backstage/backstage/commit/e262d649981ff99bb01ca7077807ae3e25e85560"}, {"source": "security-advisories@github.com", "url": "https://github.com/backstage/backstage/releases/tag/v1.49.6"}, {"source": "security-advisories@github.com", "url": "https://github.com/backstage/backstage/releases/tag/v1.50.5"}, {"source": "security-advisories@github.com", "url": "https://github.com/backstage/backstage/releases/tag/v1.54.6"}, {"source": "security-advisories@github.com", "url": "https://github.com/backstage/backstage/security/advisories/GHSA-g2v8-7jhw-pp8p"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-201"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{"bugzilla": {"description": "@backstage/plugin-scaffolder-backend: Backstage: Sensitive information exposure in Scaffolder", "id": "2547222", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2547222"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "status": "draft"}, "cwe": "CWE-201", "details": ["A flaw was found in @backstage/plugin-scaffolder-backend. An authenticated user with permission to view another user's Scaffolder task can retrieve internal task execution data, leading to sensitive information disclosure. If this execution data contains credentials for external services, an attacker could expose those credentials and perform unauthorized actions within those services."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-106501", "package_state": [{"cpe": "cpe:/a:redhat:rhdh:1", "fix_state": "Affected", "package_name": "rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend", "product_name": "Red Hat Developer Hub"}, {"cpe": "cpe:/a:redhat:rhdh:1", "fix_state": "Affected", "package_name": "rhdh/rhdh-hub-rhel9", "product_name": "Red Hat Developer Hub"}, {"cpe": "cpe:/a:redhat:ansible_portal:2", "fix_state": "Affected", "package_name": "ansible-automation-platform/automation-portal", "product_name": "Self-service automation portal 2"}, {"cpe": "cpe:/a:redhat:ansible_portal:2", "fix_state": "Affected", "package_name": "ansible-automation-platform/bootc-automation-portal-rhel9", "product_name": "Self-service automation portal 2"}], "public_date": "2026-10-06T21:32:25Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-106501\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-106501\nhttps://github.com/backstage/backstage/commit/66d2219edf0abe33ab7d0c1ced5d069d1e065be5\nhttps://github.com/backstage/backstage/commit/c19838870476a8e29144c84b1a5ac0654ec20fb5\nhttps://github.com/backstage/backstage/commit/e262d649981ff99bb01ca7077807ae3e25e85560\nhttps://github.com/backstage/backstage/releases/tag/v1.49.6\nhttps://github.com/backstage/backstage/releases/tag/v1.50.5\nhttps://github.com/backstage/backstage/releases/tag/v1.54.6\nhttps://github.com/backstage/backstage/security/advisories/GHSA-g2v8-7jhw-pp8p"], "statement": "This vulnerability is rated as an Important impact because authenticated users with read permissions to Scaffolder tasks can inspect internal run data, which may contain sensitive secrets or tokens for integrated downstream services. In environments running Red Hat Developer Hub and Ansible Automation Platform Portal where automated templates interact with protected external systems, this leak allows unauthorized third-party modifications and privilege escalation across integrated infrastructure. While exploitation requires valid portal credentials and permission to view tasks, the potential compromise of external secrets elevates the operational blast radius beyond the application boundary.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.49.6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.50.0-next.0,1.50.5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.51.0-next.0,1.54.6)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "backstage", "source": "cna", "vendor": "backstage"}, "product": "backstage", "vendor": "backstage"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.3.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.4.0,3.4.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.0.0,4.0.3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.0.4,4.1.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "plugin-scaffolder-backend", "source": "cna", "vendor": "@backstage"}, "product": "plugin-scaffolder-backend", "vendor": "backstage"}], "created": "2026-10-06T23:15:06.953620+00:00", "updated": "2026-10-07T04:30:11.447726+00:00", "vendors": ["backstage", "backstage$PRODUCT$backstage", "backstage$PRODUCT$plugin-scaffolder-backend"]}