Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by sensitive information exposure in scaffolder task logs. An authenticated user who can create and read scaffolder tasks may be able to observe sensitive values in task logs in deployments with restrictive action permissions and affected templates. Exploitation requires a denied action whose input contains such a value. This issue is fixed in version 4.1.0.
Fix
Patch, vendor advisory and mitigation references on NVD 3
- https://github.com/backstage/backstage/commit/3eb3dc59eb0da0deccd532f19eb460bb452c9efb Patch
- https://github.com/backstage/backstage/releases/tag/v1.54.6 Patch, Release Notes
- https://github.com/backstage/backstage/security/advisories/GHSA-4xvq-3m68-h444 Mitigation, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 6.5 · linuxfoundationNVD modified 2026-10-13 21:08
Affected (CPE criteria) 2
cpe:2.3:a:linuxfoundation:backstage\/plugin-scaffolder-backend:*:*:*:*:*:*:*:*cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*