backstage-plugin-scaffolder-backend

### Impact Scaffolder actions that interact with source control systems may not consistently enforce the intended credential boundaries under certain configurations. An authenticated user could perform operations with broader access than intended. ### Patches - `@backstage/plugin-scaffolder-backend` version `4.1.0` - `@backstage/plugin-scaffolder-backend-module-azure` version `0.2.25` - `@backstage/plugin-scaffolder-backend-module-bitbucket-cloud` version `0.3.10` - `@backstage/plugin-scaffolder-backend-module-bitbucket-server` version `0.2.25` - `@backstage/plugin-scaffolder-backend-module

CVE: CVE-2026-106462

### Impact An authenticated user who can create and read scaffolder tasks may be able to observe sensitive values in task logs in deployments with restrictive action permissions and affected templates. Exploitation requires a denied action whose input contains such a value. ### Patches Patched in `@backstage/plugin-scaffolder-backend` version `4.1.0` ### Workarounds - Restrict scaffolder task creation and task-log reading to trusted users. - Avoid placing centrally managed sensitive values in inputs to actions that may be denied until upgrading. ### References - [Backstage threat model]

CVE: CVE-2026-106504

### Impact An authenticated internal user may be able to view metadata for scaffolder tasks outside the visibility intended by a deployment's permission policy. Stored task secrets are not included in the affected response, and no integrity or availability impact was identified. ### Patches Patched in `@backstage/plugin-scaffolder-backend` version `4.1.0` ### Workarounds - Restrict the scaffolder task-list endpoint at the ingress or authenticating proxy to users who are permitted to view all tasks. - Avoid placing sensitive values in template input parameters until the patched package is

CVE: CVE-2026-106461

### Impact Under specific template and failure conditions, an authenticated user may be able to retrieve sensitive values from Scaffolder task events. This can expose backend-managed credentials used during task execution. ### Patches Patched in `@backstage/plugin-scaffolder-backend` version `4.1.0` ### Workarounds - Restrict Scaffolder template execution and task-event access to trusted users until the patched version is deployed.

CVE: CVE-2026-106502

### Impact An authenticated Backstage user who can read another user's Scaffolder task may receive internal execution data. In deployments where that data contains credentials for an external service, this may permit disclosure and unauthorized changes in that external service. ### Patches Patched in `@backstage/plugin-scaffolder-backend` version `4.1.0` ### Workarounds - Configure `scaffolder.task.read` with the `isTaskOwner` condition so users can only read tasks they created. - Restrict affected integrations and workflows to trusted operators until an upgrade is available.

CVE: CVE-2026-106501

### Impact An authenticated user with access to affected Scaffolder templates could bypass configured action restrictions. Depending on integration credentials, this could grant unauthorized access to repositories and related source-control resources. ### Patches Patched in `@backstage/plugin-scaffolder-backend` version `4.1.0` ### Workarounds - Restrict affected Scaffolder actions to trusted users and configure source-control integrations with least-privilege credentials.

CVE: CVE-2026-106503

### Impact Deployments that configure sensitive `scaffolder.defaultEnvironment.secrets` and allow an attacker to create or modify Scaffolder templates are affected. A template author could cause secret-derived values used during template iteration to be persisted in task logs, exposing those values to users with access to the resulting task logs. ### Patches Patched in `@backstage/plugin-scaffolder-backend` version `4.1.0` ### Workarounds - Restrict permission to create or update Template entities to fully trusted parties, as recommended by the Backstage threat model. - If that restrictio

CVE: CVE-2026-106499

### Impact An authenticated Backstage user with permission to create and read relevant scaffolder tasks may be able to infer confidential task data under specific conditions. Successful exploitation requires retained task secrets, visibility of a target task, knowledge of the secret structure, and repeated requests. ### Patches Patched in `@backstage/plugin-scaffolder-backend` version `4.1.0` ### Workarounds - At the gateway or reverse proxy, reject task-list requests that specify custom ordering, or allow ordering only by `created_at`, `status`, and `created_by`. - Restrict scaffolder ta

CVE: CVE-2026-106506

### Impact An authenticated user with permission to create and access Scaffolder tasks may, under specific timing and deployment conditions, affect files accessible to the Backstage backend. If backend application files are writable, the confidentiality, integrity, and availability of the backend may be compromised. ### Patches Patched in `@backstage/plugin-scaffolder-backend` version `4.1.0` ### Workarounds - Restrict Scaffolder task creation and task-read permissions to trusted users through the permission policy. - Limit who can register or modify templates and which Scaffolder actions

CVE: CVE-2026-106500

### Impact Authenticated users with permission to execute scaffolder dry-runs can gain access to server-configured environment secrets through the dry-run API response. Secrets are properly redacted in log output but not in all parts of the response payload.

CVE: CVE-2026-32237