Backstage Scaffolder CVE-2026-106502

Requires an authenticated Backstage user (PR:L) who can run or view a Scaffolder task, plus a template/task that (a) uses backend-managed credentials/secrets during execution and (b) fails along a specific path - the tests show checkpoint persistence failures and action errors whose reason/name/message strings embedded secret values that were not passed through the configured log redaction. The leak surfaces in Scaffolder task failure events the user can retrieve. Limiting factors that reduce real-world risk: valid authentication is mandatory, the failure/template conditions are narrow (AC:H), only deployments that actually inject secrets into scaffolder tasks are exposed, and the data is confidentiality-only (no integrity or availability impact). Installations on 4.1.0 / Backstage v1.54.6 or later are not affected.

This is a genuine but moderate-priority information-disclosure flaw (CWE-532) rather than a critical, widely-weaponizable one, and the signals are internally consistent. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.3) tells a coherent story: network-reachable but requiring an authenticated user (PR:L) and high attack complexity (AC:H), with confidentiality-only impact (C:H/I:N/A:N). The AC:H is directly corroborated by the description ('Under specific template and failure conditions'), so the network vector is not misleading - exploitation depends on a narrow task-failure code path, not a simple request. No EPSS score, KEV listing, or SSVC decision data was supplied, and there is no public exploit identified at time of analysis - the only source-code artifact is the vendor's own fix commit plus regression tests (secret redaction in NunjucksWorkflowRunner), which is remediation evidence, not proof-of-concept exploit code. The absence of KEV/EPSS is not itself a risk-lowering signal; it simply means prioritization must rest on the CVSS profile and the credential-exposure consequence. Net: prioritize patching for environments that run Scaffolder with secrets, but this is not an emergency drive-by-exploitable issue given the authentication and specific-condition requirements.

An authenticated Backstage user triggers a Scaffolder template whose task execution fails along a specific path (e.g. a checkpoint or action error) where backend-managed credentials were interpolated and not covered by log redaction. The resulting task failure event, which the user can read, embeds those credentials in its error/reason text, letting the user harvest secrets they were never meant to see. No public exploit is identified; high attack complexity (AC:H) means the failure/template conditions must align for the leak to occur.