Backstage: Sensitive information may be exposed in Scaffolder task failure events

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-106502 · Microsoft / collected KEV context

EUVD-2026-94060

GHSA-95p4-vv4g-jxxm

cve-program · CVE-2026-106502

• https://github.com/backstage/backstage/security/advisories/GHSA-95p4-vv4g-jxxm
• https://github.com/backstage/backstage/commit/3f1e869708f002fb9838624b7379deb251691b47
• https://github.com/backstage/backstage/releases/tag/v1.54.6

euvd · EUVD-2026-94060

• https://github.com/backstage/backstage/security/advisories/GHSA-95p4-vv4g-jxxm
• https://github.com/backstage/backstage/commit/3f1e869708f002fb9838624b7379deb251691b47
• https://github.com/backstage/backstage/releases/tag/v1.54.6

nvd · CVE-2026-106502

• https://github.com/backstage/backstage/commit/3f1e869708f002fb9838624b7379deb251691b47
• https://github.com/backstage/backstage/releases/tag/v1.54.6
• https://github.com/backstage/backstage/security/advisories/GHSA-95p4-vv4g-jxxm

osv · GHSA-95p4-vv4g-jxxm

• https://github.com/backstage/backstage/security/advisories/GHSA-95p4-vv4g-jxxm
• https://nvd.nist.gov/vuln/detail/CVE-2026-106502
• https://github.com/backstage/backstage/commit/3f1e869708f002fb9838624b7379deb251691b47
• https://github.com/backstage/backstage
• https://github.com/backstage/backstage/releases/tag/v1.54.6

No related operational record is retained in the current change model.