Threats affecting pkg:npm/@backstage/plugin-scaffolder-backend

A vulnerability in Backstage's plugin-scaffolder-backend may allow authenticated users to perform source control operations with broader access than intended due to inconsistent enforcement of credential boundaries. This affects scaffolder actions interacting with source control management (SCM) systems. A fix is available in version 4.1.0 and related module versions, introducing an opt-in configuration to enforce user-provided credentials. Until upgraded, restricting task creation and limiting SCM credentials can mitigate risk.

CVE-2026-106501 is a critical vulnerability in the @backstage/plugin-scaffolder-backend that allows an authenticated user to read another user's Scaffolder task and potentially access sensitive internal execution data. This data may include credentials for external services, leading to unauthorized disclosure and changes in those services. The issue affects multiple versions prior to 4.1.0 and has been patched in version 4.1.0. Mitigations include restricting task read permissions to task owners and limiting affected workflows to trusted operators until patched.

A vulnerability in the @backstage/plugin-scaffolder-backend before version 4.1.0 allows secret-derived values configured in scaffolder.defaultEnvironment.secrets to be exposed in scaffolder task logs. This occurs if an attacker can create or modify Scaffolder templates, potentially leaking sensitive information to users with access to those logs.

An authorization bypass vulnerability exists in the Backstage plugin-scaffolder-backend that allows an authenticated user with access to certain Scaffolder templates to bypass configured action restrictions. This could lead to unauthorized access to repositories and source-control resources depending on integration credentials. The issue is patched in version 4.1.0 of the plugin. Workarounds include restricting affected actions to trusted users and using least-privilege credentials for source-control integrations.

CVE-2026-106500 is a vulnerability in the @backstage/plugin-scaffolder-backend prior to version 4.1.0. It allows an authenticated user with permission to create and access Scaffolder tasks to potentially affect files accessible to the backend under certain timing and deployment conditions. If backend application files are writable, this can compromise the confidentiality, integrity, and availability of the backend. The issue has been patched in version 4.1.0. Mitigations include restricting task creation and read permissions to trusted users, limiting template registration and actions, and running backend files as read-only outside a dedicated Scaffolder working directory.

An authorization vulnerability in the @backstage/plugin-scaffolder-backend prior to version 4.1.0 allows an authenticated internal user to view metadata for scaffolder tasks beyond their intended permission scope. The vulnerability does not expose stored task secrets and does not impact data integrity or availability. A patch is available in version 4.1.0. Workarounds include restricting access to the task-list endpoint and avoiding sensitive data in template inputs until patched.

Backstage is an open framework for building developer portals. Prior to 3.1.5, authenticated users with permission to execute scaffolder dry-runs can gain access to server-configured environment secrets through the dry-run API response. Secrets are properly redacted in log output but not in all parts of the response payload. Deployments that have configured scaffolder.defaultEnvironment.secrets are affected. This is patched in @backstage/plugin-scaffolder-backend version 3.1.5.