CVE-2026-106504

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 4.1.0

Description The @backstage/plugin-scaffolder-backend package allows sensitive information exposure within scaffolder task logs. An authenticated user with permissions to create and read scaffolder tasks can observe sensitive values in these logs. This occurs in deployments using restrictive action permissions and affected templates, specifically when a denied action is triggered by an input containing a sensitive value.

Recommendations Update to version 4.1.0.