{
  "schemaVersion": 1,
  "incident": {
    "id": "cve-2026-106501",
    "url": "https://cveboard.org/i/cve-2026-106501",
    "urlPt": "https://cveboard.org/pt/i/cve-2026-106501",
    "json": "https://cveboard.org/i/cve-2026-106501.json",
    "kind": "vuln",
    "live": false,
    "knownExploited": false,
    "severity": "critical",
    "title": "Backstage: Sensitive information exposure in Scaffolder",
    "summary": "An authenticated Backstage user who can read another user's Scaffolder task may receive internal execution data. In deployments where that data contains credentials for an external service, this may permit disclosure and unauthorized changes in that external service.",
    "titlePt": "Backstage: exposição de informações sensíveis no Scaffolder",
    "summaryPt": "Um usuário autenticado do Backstage que pode ler a tarefa Scaffolder de outro usuário pode receber dados de execução internos. Em implantações onde esses dados contêm credenciais para um serviço externo, isso pode permitir a divulgação e alterações não autorizadas nesse serviço externo.",
    "cves": [
      "CVE-2026-106501"
    ],
    "ghsa": "GHSA-g2v8-7jhw-pp8p",
    "cvss": {
      "score": 9.6,
      "version": "3.1"
    },
    "epss": {
      "percentage": 0.00483,
      "percentile": 0.40613,
      "asOf": "2026-10-23"
    },
    "packages": [
      {
        "ecosystem": "npm",
        "name": "@backstage/plugin-scaffolder-backend",
        "vulnerable": "< 3.3.1",
        "fixed": "3.3.1",
        "advisory": "GHSA-g2v8-7jhw-pp8p"
      },
      {
        "ecosystem": "npm",
        "name": "@backstage/plugin-scaffolder-backend",
        "vulnerable": ">= 3.4.0, < 3.4.1",
        "fixed": "3.4.1",
        "advisory": "GHSA-g2v8-7jhw-pp8p"
      },
      {
        "ecosystem": "npm",
        "name": "@backstage/plugin-scaffolder-backend",
        "vulnerable": ">= 4.0.0, < 4.0.3",
        "fixed": "4.0.3",
        "advisory": "GHSA-g2v8-7jhw-pp8p"
      },
      {
        "ecosystem": "npm",
        "name": "@backstage/plugin-scaffolder-backend",
        "vulnerable": ">= 4.0.4, < 4.1.0",
        "fixed": "4.1.0",
        "advisory": "GHSA-g2v8-7jhw-pp8p"
      }
    ],
    "vendor": null,
    "product": null,
    "kev": null,
    "breach": null,
    "retracted": false,
    "sources": [
      {
        "label": "GitHub Advisory Database",
        "url": "https://github.com/advisories/GHSA-g2v8-7jhw-pp8p"
      }
    ],
    "publishedAt": "2026-10-07T17:59:19.000Z",
    "updatedAt": "2026-10-07T17:59:19.000Z"
  },
  "live": false,
  "events": [
    {
      "id": "ghsa:GHSA-g2v8-7jhw-pp8p:ghsa_published:2026-10-07T17:59:19.000Z",
      "incidentId": "cve-2026-106501",
      "type": "ghsa_published",
      "at": "2026-10-07T17:59:19.000Z",
      "detail": {
        "ghsa": "GHSA-g2v8-7jhw-pp8p",
        "severity": "critical",
        "fixed": "3.3.1, 3.4.1, 4.0.3, 4.1.0"
      }
    }
  ]
}