{"id":"EUVD-2026-94060","enisaUuid":"d68a3939-439a-3b70-8aa2-fa7ddbf2d014","description":"Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package could expose sensitive information in Scaffolder task failure events. Under specific template and failure conditions, an authenticated user may retrieve backend-managed credentials used during task execution from affected task events. This issue is fixed in version 4.1.0.","datePublished":"Oct 6, 2026, 9:34:43 PM","dateUpdated":"Oct 7, 2026, 3:09:21 PM","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","references":"https://github.com/backstage/backstage/security/advisories/GHSA-95p4-vv4g-jxxm\nhttps://github.com/backstage/backstage/commit/3f1e869708f002fb9838624b7379deb251691b47\nhttps://github.com/backstage/backstage/releases/tag/v1.54.6\n","aliases":"CVE-2026-106502\nGHSA-95p4-vv4g-jxxm\n","assigner":"GitHub_M","epss":0.29,"enisaIdProduct":[{"id":"5c68c67b-3465-3b9d-991c-e3650efef603","product":{"name":"plugin-scaffolder-backend","vendor":{"name":"@backstage"}},"product_version":"\u003c 4.1.0"},{"id":"de649155-615f-320b-9b97-58e84aaa02bd","product":{"name":"backstage","vendor":{"name":"backstage"}},"product_version":"\u003c 1.54.6"}],"enisaIdVendor":[{"id":"cb35bafc-8a32-3d04-a99e-9c2b8af93cde","vendor":{"name":"backstage"}},{"id":"e5dfd017-8937-35cc-a2eb-487154b65220","vendor":{"name":"@backstage"}}],"enisaIdVulnerability":[{"id":"207a88d9-e6d7-3c7f-8d9c-9698b609c544","vulnerability":{"id":"GHSA-95p4-vv4g-jxxm","description":"Backstage may expose sensitive information in Scaffolder task failure events","datePublished":"Oct 7, 2026, 4:24:51 PM","dateUpdated":"Oct 7, 2026, 4:24:51 PM","baseScore":0.0,"references":"https://github.com/backstage/backstage/security/advisories/GHSA-95p4-vv4g-jxxm\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-106502\nhttps://github.com/backstage/backstage/commit/3f1e869708f002fb9838624b7379deb251691b47\nhttps://github.com/backstage/backstage\nhttps://github.com/backstage/backstage/releases/tag/v1.54.6\n","enisa_id":"EUVD-2026-94060\n","aliases":"GHSA-95p4-vv4g-jxxm\nCVE-2026-106502\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 2:02:26 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"db9b1e6b-c0f7-3a83-b57b-de3b28ed6af1","vulnerability":{"id":"CVE-2026-106502","description":"Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package could expose sensitive information in Scaffolder task failure events. Under specific template and failure conditions, an authenticated user may retrieve backend-managed credentials used during task execution from affected task events. This issue is fixed in version 4.1.0.","datePublished":"Oct 6, 2026, 9:34:43 PM","dateUpdated":"Oct 7, 2026, 3:09:21 PM","status":"PUBLISHED","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","references":"https://github.com/backstage/backstage/security/advisories/GHSA-95p4-vv4g-jxxm\nhttps://github.com/backstage/backstage/commit/3f1e869708f002fb9838624b7379deb251691b47\nhttps://github.com/backstage/backstage/releases/tag/v1.54.6\n","enisa_id":"EUVD-2026-94060\n","assigner":"GitHub_M","epss":0.29,"dataProcessed":"Oct 30, 2026, 7:16:28 AM","vulnerabilityProduct":[{"id":"07e9ae3c-0fb0-3ec7-a9c3-62c079fb9606","product":{"name":"backstage","vendor":{"name":"backstage"}},"product_version":"\u003c 1.54.6"},{"id":"c55175a0-c44b-3772-991e-c34094828dc3","product":{"name":"plugin-scaffolder-backend","vendor":{"name":"@backstage"}},"product_version":"\u003c 4.1.0"}],"vulnerabilityVendor":[{"id":"2f5ac6d9-ca05-3f7b-af0d-060a2b8f8f20","vendor":{"name":"@backstage"}},{"id":"65df7b84-e129-32c9-84c6-750b2718e024","vendor":{"name":"backstage"}}]}}],"enisaIdAdvisory":[]}