CVE-2026-106506: Backstage has improper input validation in scaffolder task list ordering

October 7, 2026

An authenticated Backstage user with permission to create and read relevant scaffolder tasks may be able to infer confidential task data under specific conditions. Successful exploitation requires retained task secrets, visibility of a target task, knowledge of the secret structure, and repeated requests.

References

github.com/advisories/GHSA-vwp5-f99x-x3rq
github.com/backstage/backstage/commit/e673a869449874a9169e8f89852e75e862011b93
github.com/backstage/backstage/releases/tag/v1.54.6
github.com/backstage/backstage/security/advisories/GHSA-vwp5-f99x-x3rq
nvd.nist.gov/vuln/detail/CVE-2026-106506

Code Behaviors & Features

Detect and mitigate CVE-2026-106506 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →