CVE-2026-106506: backstage — Fix

Description

Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by improper input validation in scaffolder task list ordering. An authenticated Backstage user with permission to create and read relevant scaffolder tasks may be able to infer confidential task data under specific conditions. Successful exploitation requires retained task secrets, visibility of a target task, knowledge of the secret structure, and repeated requests. This issue is fixed in version 4.1.0.

Is your site exposed to CVE-2026-106506?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

5.3

MEDIUM

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS — Exploit Prediction

0.0022

Probability of exploitation

0.12%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

Weakness Type (CWE)

CWE-202 CWE-202

CWE-203 CWE-203

Affected Products

Vendor	Product	Versions
linuxfoundation	backstage\/plugin-scaffolder-backend	< 4.1.0
linuxfoundation	backstage	< 1.54.6

References

Advisories & Patches

https://github.com/backstage/backstage/commit/e673a869449874a9169e8f89852e75e862011b93 https://github.com/backstage/backstage/releases/tag/v1.54.6 https://github.com/backstage/backstage/security/advisories/GHSA-vwp5-f99x-x3rq

Frequently Asked Questions

What is CVE-2026-106506? +

Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by improper input validation in scaffolder task list ordering. An authenticated Backstage user with permission to create and read relevant scaffolder tasks may be able to infer confidential task data under specific conditions. Successful exploitation requires retained task secrets, visibility of a target task, knowledge of the secret structure, and repeated requests. This issue is fixed in version 4.1.0. It has a CVSS v3.1 base score of 5.3 (MEDIUM).

How severe is CVE-2026-106506? +

CVE-2026-106506 has a CVSS v3.1 score of 5.3 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance. The EPSS score is 0.0022, placing it in the 0th percentile for exploitation probability.

What products are affected by CVE-2026-106506? +

CVE-2026-106506 affects products from linuxfoundation, specifically: backstage, backstage\/plugin-scaffolder-backend. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2026-106506? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-16520

Improper input validation and Exposure of sensitive information through data queries vulnerability in Genians Genian NAC V4.0, Genians Genian NAC …

CVE-2026-79633

vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. Missing authorization checks allowed authenticated users to perform actions …

CVE-2026-79613

vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. Unauthenticated attackers could access comments associated with non-public content …

CVE-2026-79620

Exposure of sensitive information through data queries vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. An improper …

CVE-2026-103440

Exposure of sensitive information through data queries vulnerability in The Wikimedia Foundation MediaWiki PageTriage extension allows Information Elicitation. This issue …

CVE-2026-118544

Exposure of Sensitive Information Through Data Queries vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core …