{"id":"EUVD-2026-94057","enisaUuid":"8098c859-ab32-3d7c-9216-91110ad2e662","description":"Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package could expose secret-derived values in Scaffolder task logs. Deployments that configure sensitive scaffolder.defaultEnvironment.secrets and allow an attacker to create or modify Scaffolder templates are affected. A template author could cause secret-derived values used during template iteration to be persisted and exposed to users who can access the resulting task logs. This issue is fixed in version 4.1.0.","datePublished":"Oct 6, 2026, 9:25:56 PM","dateUpdated":"Oct 7, 2026, 5:46:09 PM","baseScore":4.9,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","references":"https://github.com/backstage/backstage/security/advisories/GHSA-mfvq-x7vr-rgqg\nhttps://github.com/backstage/backstage/commit/dc30fae2d96cb1606d36cc40b242f9b9e539bd70\nhttps://github.com/backstage/backstage/releases/tag/v1.54.6\n","aliases":"CVE-2026-106499\nGHSA-mfvq-x7vr-rgqg\n","assigner":"GitHub_M","epss":0.27,"enisaIdProduct":[{"id":"22eb6dfa-c956-36b5-967e-74b03ddba53f","product":{"name":"plugin-scaffolder-backend","vendor":{"name":"@backstage"}},"product_version":"\u003c 4.1.0"},{"id":"f4a56898-def3-313c-8813-7027f47f10c8","product":{"name":"backstage","vendor":{"name":"backstage"}},"product_version":"\u003c 1.54.6"}],"enisaIdVendor":[{"id":"cd786c50-95e8-3f5c-9993-052280d16db7","vendor":{"name":"@backstage"}},{"id":"f08c39c5-9576-3d58-8f6f-8dddab691c2c","vendor":{"name":"backstage"}}],"enisaIdVulnerability":[{"id":"344f1b05-6977-3a57-8e56-056c45a2086f","vulnerability":{"id":"CVE-2026-106499","description":"Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package could expose secret-derived values in Scaffolder task logs. Deployments that configure sensitive scaffolder.defaultEnvironment.secrets and allow an attacker to create or modify Scaffolder templates are affected. A template author could cause secret-derived values used during template iteration to be persisted and exposed to users who can access the resulting task logs. This issue is fixed in version 4.1.0.","datePublished":"Oct 6, 2026, 9:25:56 PM","dateUpdated":"Oct 7, 2026, 5:46:09 PM","status":"PUBLISHED","baseScore":4.9,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","references":"https://github.com/backstage/backstage/security/advisories/GHSA-mfvq-x7vr-rgqg\nhttps://github.com/backstage/backstage/commit/dc30fae2d96cb1606d36cc40b242f9b9e539bd70\nhttps://github.com/backstage/backstage/releases/tag/v1.54.6\n","enisa_id":"EUVD-2026-94057\n","assigner":"GitHub_M","epss":0.27,"dataProcessed":"Nov 2, 2026, 7:16:59 AM","vulnerabilityProduct":[{"id":"66ff5d18-99a7-3c58-8939-2b047a2e4655","product":{"name":"backstage","vendor":{"name":"backstage"}},"product_version":"\u003c 1.54.6"},{"id":"c06a0124-c2d8-3a70-8721-4b55a2220ccf","product":{"name":"plugin-scaffolder-backend","vendor":{"name":"@backstage"}},"product_version":"\u003c 4.1.0"}],"vulnerabilityVendor":[{"id":"3d512330-91f7-3ac4-9d9b-841920b2c228","vendor":{"name":"@backstage"}},{"id":"4a5285cf-aab4-3761-96fe-73875dddf867","vendor":{"name":"backstage"}}]}},{"id":"f07521e4-15c6-3b37-b0da-081c11adb97b","vulnerability":{"id":"GHSA-mfvq-x7vr-rgqg","description":"Backstage: Secret-derived values may be exposed in scaffolder task logs","datePublished":"Oct 7, 2026, 5:59:14 PM","dateUpdated":"Oct 7, 2026, 5:59:14 PM","baseScore":0.0,"references":"https://github.com/backstage/backstage/security/advisories/GHSA-mfvq-x7vr-rgqg\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-106499\nhttps://github.com/backstage/backstage/commit/dc30fae2d96cb1606d36cc40b242f9b9e539bd70\nhttps://github.com/backstage/backstage\nhttps://github.com/backstage/backstage/releases/tag/v1.54.6\n","enisa_id":"EUVD-2026-94057\n","aliases":"GHSA-mfvq-x7vr-rgqg\nCVE-2026-106499\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:07:07 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}