CVE-2026-106499: Backstage: Secret-derived values may be exposed in scaffolder task logs

October 7, 2026

Deployments that configure sensitive scaffolder.defaultEnvironment.secrets and allow an attacker to create or modify Scaffolder templates are affected. A template author could cause secret-derived values used during template iteration to be persisted in task logs, exposing those values to users with access to the resulting task logs.

References

github.com/advisories/GHSA-mfvq-x7vr-rgqg
github.com/backstage/backstage/commit/dc30fae2d96cb1606d36cc40b242f9b9e539bd70
github.com/backstage/backstage/releases/tag/v1.54.6
github.com/backstage/backstage/security/advisories/GHSA-mfvq-x7vr-rgqg
nvd.nist.gov/vuln/detail/CVE-2026-106499

Code Behaviors & Features

Detect and mitigate CVE-2026-106499 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →