Backstage Scaffolder CVE-2026-106506

Requires an authenticated Backstage user who already holds permission to create and read the relevant scaffolder tasks (PR:L), so this is not remotely reachable by anonymous attackers. Four additional stacked conditions must all hold, per the advisory: (1) the target task's secrets must still be retained rather than purged, (2) the attacker must have visibility of the target task, (3) the attacker must know the structure of the secret being inferred, and (4) the attack needs many repeated list requests manipulating the order-by parameter on secret-bearing fields. These conditions, which map directly to AC:H, sharply limit practical exploitation and mean impact is inference/partial leakage rather than guaranteed full secret disclosure; only deployments on versions prior to the fix with secret retention enabled are exposed.

This is a genuinely moderate-priority, low-urgency issue rather than a high-impact emergency, and the 5.3 MEDIUM CVSS reflects that accurately. The vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N shows network reach but three substantial brakes: high attack complexity (AC:H), required authentication (PR:L), and no integrity or availability impact (I:N/A:N) - only confidentiality (C:H). The description reinforces the AC:H rating by listing multiple stacked preconditions (retained task secrets, visibility of a target task, knowledge of the secret structure, and many repeated requests), confirming this is a slow inference/side-channel leak via the task-list order-by parameter, not a direct dump of secrets. No EPSS score, no CISA KEV listing, and no public exploit code were provided in the intelligence, so exploitation status is 'no public exploit identified at time of analysis.' There is no conflict between signals here - every source (CVSS, CWE-202 exposure-through-data-queries, and the commit that merely restricts order-by to created_at/status/created_by) points consistently to a constrained, authenticated information-inference weakness. The confidentiality rating of C:H should be read with care: the description says an attacker 'may be able to infer' data 'under specific conditions,' so real-world impact is likely partial inference rather than reliable full secret recovery - treat C:H as an upper bound.

An authenticated Backstage user who holds permission to create and read scaffolder tasks submits task-list requests manipulating the ordering parameter (e.g. order=asc:secrets) against the scaffolder-backend API. By repeatedly reordering results on an unsupported secret-bearing field and observing how a target task sorts relative to others, the attacker incrementally infers confidential task secret data. No public exploit code was identified, and success requires the secret to still be retained, the target task to be visible, and many iterated requests.