CVE-2026-106504: Backstage has sensitive information exposure in scaffolder task logs

October 7, 2026

An authenticated user who can create and read scaffolder tasks may be able to observe sensitive values in task logs in deployments with restrictive action permissions and affected templates. Exploitation requires a denied action whose input contains such a value.

References

github.com/advisories/GHSA-4xvq-3m68-h444
github.com/backstage/backstage/commit/3eb3dc59eb0da0deccd532f19eb460bb452c9efb
github.com/backstage/backstage/releases/tag/v1.54.6
github.com/backstage/backstage/security/advisories/GHSA-4xvq-3m68-h444
nvd.nist.gov/vuln/detail/CVE-2026-106504

Code Behaviors & Features

Detect and mitigate CVE-2026-106504 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →