CVE-2026-106506

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 4.1.0

Description The @backstage/plugin-scaffolder-backend package contains improper input validation regarding the ordering of scaffolder task lists. An authenticated user with permissions to create and read scaffolder tasks can potentially infer confidential task data. This requires the attacker to have visibility of a target task, knowledge of the secret structure, retained task secrets, and the ability to make repeated requests.

Recommendations Update to version 4.1.0.