Description
Backstage is an open framework for building developer portals. Prior to version 3.1.4, a malicious scaffolder template can bypass the log redaction mechanism to exfiltrate secrets provided run through task event logs. This issue has been patched in version 3.1.4.
Scores
CVSS v3
2.0
EPSS
0.0001
EPSS Percentile
0.8%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-532
Status
published
Products (3)
backstage/plugin-scaffolder-backend
0 - 3.1.4npm
linuxfoundation/\@backstage\/plugin-scaffolder-backend
< 3.1.4
linuxfoundation/backstage\/plugin-scaffolder-backend
< 3.1.4
Published
Mar 07, 2026
Tracked Since
Mar 07, 2026