CVE-2026-106499: Backstage Information Disclosure Flaw

CVE-2026-106499 Overview

CVE-2026-106499 affects Backstage, an open framework for building developer portals. The @backstage/plugin-scaffolder-backend package can expose secret-derived values in Scaffolder task logs prior to version 4.1.0. The flaw occurs when deployments configure sensitive values in scaffolder.defaultEnvironment.secrets and permit untrusted users to create or modify Scaffolder templates. A template author can craft iteration logic that persists secret-derived values into task logs accessible to downstream users. The weakness maps to [CWE-532: Insertion of Sensitive Information into Log File].

Critical Impact
Authenticated template authors can leak environment secrets into Scaffolder task logs, exposing credentials to any user with log access.

Affected Products

Backstage @backstage/plugin-scaffolder-backend prior to 4.1.0
Backstage deployments using scaffolder.defaultEnvironment.secrets
Backstage release bundles prior to v1.54.6

Discovery Timeline

2026-10-06 - CVE-2026-106499 published to NVD
2026-10-07 - Last updated in NVD database

Technical Details for CVE-2026-106499

Vulnerability Analysis

Backstage's Scaffolder executes templated workflows defined by YAML templates. Template steps can iterate over collections using the each directive, and iteration context is rendered through the Nunjucks workflow runner. The runner previously included secrets and environment.secrets in the context used to compute per-iteration values. When a template author referenced these values during iteration preparation, the resolved values were persisted into task metadata and surfaced through task logs.

Any user with permission to read Scaffolder task logs could retrieve credentials, tokens, or other sensitive strings sourced from the configured environment secrets. The issue requires an attacker to hold template authoring privileges, which limits exposure to insider or compromised-maintainer scenarios.

Root Cause

The root cause resides in plugins/scaffolder-backend/src/scaffolder/tasks/NunjucksWorkflowRunner.ts. The each resolution path reused the full pre-iteration context, which included secret values, when computing iteration output. Resolved values flowed into persistent task artifacts rather than being redacted before logging.

Attack Vector

An attacker with Scaffolder template creation or modification rights authors a template that references secrets.* or environment.secrets.* inside an each block. On execution, the Nunjucks runner materializes the secret values during iteration. The resolved iteration data is written to task logs that other authenticated Backstage users can view.

typescript

           ['secrets'],
           preIterationContext.secrets as NunjitsuTemplateValue,
         );
+      const hasSecrets =
+        Object.keys(task.secrets ?? {}).length > 0 ||
+        Object.keys(this.environment?.secrets ?? {}).length > 0;
+      const preparedPreIterationContextNoSecrets = preparedPreIterationContext
+        .withValue(['secrets'], {})
+        .withValue(['environment', 'secrets'], {});
 
       const resolvedEach =
         step.each &&

Source: Backstage security patch commit dc30fae. The patch builds a secrets-stripped context (preparedPreIterationContextNoSecrets) that the runner uses for iteration resolution when secrets are present.

Detection Methods for CVE-2026-106499

Indicators of Compromise

Scaffolder task logs containing strings that match configured scaffolder.defaultEnvironment.secrets values.
Template commits introducing each loops that reference secrets.* or environment.secrets.*.
Unexpected template modifications by accounts without a legitimate scaffolder development role.

Detection Strategies

Audit Git history for Scaffolder template changes that reference the secrets or environment.secrets namespaces.
Scan historical Scaffolder task logs for known secret substrings using automated secret detection tools.
Correlate Backstage audit events for template create or update actions with task execution logs.

Monitoring Recommendations

Forward Backstage task log output to a centralized log store with secret-pattern detection enabled.
Alert on new template authors and on templates that introduce iteration over sensitive namespaces.
Monitor the @backstage/plugin-scaffolder-backend package version across deployments to confirm patch adoption.

How to Mitigate CVE-2026-106499

Immediate Actions Required

Upgrade @backstage/plugin-scaffolder-backend to version 4.1.0 or later, or adopt the Backstage v1.54.6 release bundle.
Rotate any credentials configured under scaffolder.defaultEnvironment.secrets that may have been exposed through task logs.
Review and purge historical Scaffolder task logs that could contain leaked secret-derived values.

Patch Information

The fix landed in Backstage commit dc30fae2 and ships in Backstage release v1.54.6. Full advisory details are available in GitHub Security Advisory GHSA-mfvq-x7vr-rgqg.

Workarounds

Restrict Scaffolder template authoring to a small set of trusted maintainers and enforce code review on template changes.
Remove sensitive values from scaffolder.defaultEnvironment.secrets until the upgrade is applied.
Limit who can view Scaffolder task logs through Backstage permissions and backend access controls.

bash

# Upgrade the affected package in a Backstage workspace
yarn up @backstage/plugin-scaffolder-backend@^4.1.0
yarn install
yarn tsc && yarn build:backend