EUVD-2026-94059
GHSA-g2v8-7jhw-pp8p
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Authenticated user reads task data over the network (AV:N/AC:L/PR:L/UI:N); leaked external credentials affect a separate system (S:C) enabling disclosure and unauthorized changes (C:H/I:H), no availability impact.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
5DescriptionCVE.org
Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by sensitive information exposure in scaffolder. An authenticated Backstage user who can read another user's Scaffolder task may receive internal execution data. In deployments where that data contains credentials for an external service, this may permit disclosure and unauthorized changes in that external service. This issue is fixed in versions 3.3.1, 3.4.1, 4.0.3 and 4.1.0.
AnalysisAI
Authenticated Backstage users can retrieve the internal execution data of other users' Scaffolder tasks - notably the SerializedTask secrets field (including __initiatorCredentials) and state.checkpoints - through the scaffolder-backend task API in versions prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0. Where scaffolder tasks or templates place credentials for an external service into those fields, the disclosure can extend to unauthorized changes in that external system, which is reflected in the assigned CRITICAL 9.6 score (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) and its scope change. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a valid authenticated Backstage account whose permissions allow reading another user's Scaffolder task through the scaffolder-backend task API (e.g. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The input assigns a CRITICAL 9.6 via CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N - network-reachable, low-complexity, requiring only low privileges (any authenticated Backstage user), with a scope change because leaked data can compromise an external system. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade @backstage/plugin-scaffolder-backend and @backstage/plugin-scaffolder-common to 3.3.1, 3.4.1, 4.0.3 or 4.1.0 depending on your release line, or move the Backstage platform to v1.49.6, v1.50.5 or v1.54.6 respectively; the upstream fixes are commits 66d2219edf0abe33ab7d0c1ced5d069d1e065be5, c19838870476a8e29144c84b1a5ac0654ec20fb5 and e262d649981ff99bb01ca7077807ae3e25e85560, and the vendor advisory is at https://github.com/backstage/backstage/security/advisories/GHSA-g2v8-7jhw-pp8p. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every Backstage deployment running scaffolder-backend at versions below 3.3.1, 3.4.1, 4.0.3 or 4.1.0 and treat them as exposed; do not wait for a patch, since no vendor-released patch has been identified at time of analysis. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Backstage is an open platform for building developer portals. Rated critical severity (CVSS 9.9), this vulnerability is
Authenticated users who can register or modify a TechDocs documentation source can achieve code execution inside the Bac
Arbitrary Python code execution in Backstage's @backstage/plugin-techdocs-node (versions < 1.13.11 and = 1.14.0) lets a
Authenticated remote code execution in the @backstage/plugin-techdocs-node package shipped with the Backstage developer
Improper task-state validation in the @backstage/plugin-scaffolder-backend plugin (Backstage versions prior to 3.3.1, 3.
Path traversal in the Backstage Scaffolder Bitbucket pull-request publish actions allows an authenticated user who can e
Improper input validation in the @backstage/plugin-scaffolder-backend-module-sentry scaffolder actions (Backstage 0.3.0
@backstage/plugin-scaffolder-backend is the backend for the default Backstage software templates. Rated high severity (C
Improper authentication in the Backstage @backstage/plugin-auth-backend-module-oidc-provider package prior to 0.4.20 let
Server-side request forgery in the Backstage @backstage/plugin-techdocs-node package (0.11.12 through 1.14.6, and 1.15.0
Improper URL validation in the @backstage/plugin-catalog-backend package of Backstage prior to 3.5.1, 3.6.2, 3.7.2, 3.8.
Improper validation of MkDocs Markdown extension configuration in Backstage's TechDocs Node package (@backstage/plugin-t
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today