Executive brief
Backstage is an open-source framework used to build internal developer portals. A logging flaw in the Scaffolder component, which automates software creation, could cause sensitive secrets to be written in plain text to system logs. If exploited, an attacker with access to these logs could obtain credentials or API keys, potentially leading to unauthorized access to other integrated corporate systems.
Technical details
A vulnerability in @backstage/plugin-scaffolder-backend (CWE-532) exists where the fetch:template action performs duplicate logging of input parameters. While one log path is correctly redacted, a second path (specifically involving 'splat' values in the logger transport) emits a pre-redaction copy of the input values. If a template author passes sensitive data via the {{ secrets }} bag to this action, those secrets are written to the Scaffolder or server logs. Exploitation requires the attacker to have high privileges to view logs and for a user to trigger a template that utilizes secrets. The issue is fixed in version 2.1.1 by removing the duplicate log path.
Affected products
- Backstage @backstage/plugin-scaffolder-backend <= 2.1.0
Timeline
- 2025-08-15: disclosed
- 2025-08-15: advisory
- 2025-08-15: patched