Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
📦
📦 npm
Not in CISA KEV
MEDIUM severity

Backstage: Secret-derived values may be exposed in scaffolder task logsGHSA-mfvq-x7vr-rgqg

MEDIUMFix: backstage/backstage@dc30fae

GHSA-mfvq-x7vr-rgqg is a medium-severity (CVSS 4.9) CWE-532 vulnerability in @backstage/plugin-scaffolder-backend. A fix is available for @backstage/plugin-scaffolder-backend — see the affected versions and patch details below.

Also known asCVE-2026-106499
Published
Updated
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Oct 23, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

No confirmed exploitation observed yet

  • CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for GHSA-mfvq-x7vr-rgqg.

EPSS Exploitation Probability

via FIRST.org ↗
0.3%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs18th percentile — riskier than 18% of all scored CVEsHighest risk

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

GHSA-mfvq-x7vr-rgqg by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.

Where this sits among everything scored

Of 394,803 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.

Real-World Exposure

1 pkg affected

How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.

69other npm packages depend on this — each one inherits the vulnerability until it's patched upstream
@backstage/plugin-scaffolder-backendnpm
68Kdownloads / week

Description

Impact

Deployments that configure sensitive scaffolder.defaultEnvironment.secrets and allow an attacker to create or modify Scaffolder templates are affected. A template author could cause secret-derived values used during template iteration to be persisted in task logs, exposing those values to users with access to the resulting task logs.

Patches

Patched in @backstage/plugin-scaffolder-backend version 4.1.0

Workarounds

  • Restrict permission to create or update Template entities to fully trusted parties, as recommended by the Backstage threat model.
  • If that restriction cannot be guaranteed, remove sensitive values from scaffolder.defaultEnvironment.secrets until a patched version is available.

No complete workaround is known that preserves both untrusted template authoring and access to sensitive default-environment secrets.

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
📦npm@backstage/plugin-scaffolder-backendall versions4.1.0npm install @backstage/plugin-scaffolder-backend@4.1.0

Affected Products

2 products · 2 configurations
Application
backstagelinuxfoundation
< 1.54.6
range
Application
backstage\/plugin-scaffolder-backendlinuxfoundation
< 4.1.0
range

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for @backstage/plugin-scaffolder-backend, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update @backstage/plugin-scaffolder-backend to 4.1.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-mfvq-x7vr-rgqg is resolved across your whole dependency graph.

  3. Workarounds

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Fixing This On Your OS

If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.

Red HatModerate

This vulnerability is rated as Moderate because successful exploitation requires elevated privileges to create or alter software templates, alongside a specific configuration defining sensitive environment secrets. In typical Red Hat Developer Hub deployments, template authoring is restricted to trusted administrators…

Workaround published by Red Hat
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Source: Red Hat security advisory for GHSA-mfvq-x7vr-rgqg (CC BY 4.0)

Frequently Asked Questions

### Impact Deployments that configure sensitive `scaffolder.defaultEnvironment.secrets` and allow an attacker to create or modify Scaffolder templates are affected. A template author could cause secret-derived values used during template iteration to be persisted in task logs, exposing those values to users with access to the resulting task logs. ### Patches Patched in `@backstage/plugin-scaffolder-backend` version `4.1.0` ### Workarounds - Restrict permission to create or update Template entities to fully trusted parties, as recommended by the Backstage threat model. - If that restrictio
O3 Security · Impact-Aware SCA

Is GHSA-mfvq-x7vr-rgqg in your dependencies?

Find it across npm, including transitive dependencies.

Scan my dependencies How O3 SCA works
Backstage: Secret-derived values may be exposed in…