# CVE-2025-55285: Backstage Scaffolder secret leakage in logs via fetch:template

Source: https://junglewise.ai/threats/cve-2025-55285-backstage-scaffolder-secret-leakage-in-logs-via-fetch-template  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-08-15. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2025-55285 · Severity: low · CVSS 3.1 · Published 2025-08-15

Backstage is an open-source framework used to build internal developer portals. A logging flaw in the Scaffolder component, which automates software creation, could cause sensitive secrets to be written in plain text to system logs. If exploited, an attacker with access to these logs could obtain credentials or API keys, potentially leading to unauthorized access to other integrated corporate systems.

Technologies: [Backstage Scaffolder Backend Plugin](https://junglewise.ai/threats/technologies/scaffolder-backend-plugin), [@backstage/plugin-scaffolder-backend (npm)](https://junglewise.ai/threats/technologies/backstage-plugin-scaffolder-backend). Vendors: [Backstage](https://junglewise.ai/threats/vendors/backstage), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2025-55285 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-55285 being exploited in the wild.

**How severe is CVE-2025-55285?** Low severity, with a CVSS score of 3.1, published 15 August 2025.

**Which products and versions are affected?** Backstage Scaffolder Backend Plugin <= 2.1.0; @backstage/plugin-scaffolder-backend (npm) SEMVER:introduced=0,fixed=2.1.1.

**Is there a fix for CVE-2025-55285?** Yes. @backstage/plugin-scaffolder-backend (npm): upgrade to 2.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-55285 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-55285?** Check whether you run Backstage Scaffolder Backend Plugin or @backstage/plugin-scaffolder-backend (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @backstage/plugin-scaffolder-backend (npm): upgrade to 2.1.1 or later

  ```sh
  npm install @backstage/plugin-scaffolder-backend@2.1.1
  ```


## Technical details

A vulnerability in @backstage/plugin-scaffolder-backend (CWE-532) exists where the fetch:template action performs duplicate logging of input parameters. While one log path is correctly redacted, a second path (specifically involving 'splat' values in the logger transport) emits a pre-redaction copy of the input values. If a template author passes sensitive data via the {{ secrets }} bag to this action, those secrets are written to the Scaffolder or server logs. Exploitation requires the attacker to have high privileges to view logs and for a user to trigger a template that utilizes secrets. The issue is fixed in version 2.1.1 by removing the duplicate log path.

## Affected products

- Backstage @backstage/plugin-scaffolder-backend <= 2.1.0

## Identifiers

- CVE-2025-55285
- GHSA-3x3q-ghcp-whf7

## Timeline

- 2025-08-15: disclosed
- 2025-08-15: advisory
- 2025-08-15: patched

## References

- [https://github.com/backstage/backstage/security/advisories/GHSA-3x3q-ghcp-whf7](https://github.com/backstage/backstage/security/advisories/GHSA-3x3q-ghcp-whf7)
- [https://github.com/backstage/backstage/commit/c371f6fe12371de31dca537510e6653e287cdc2e](https://github.com/backstage/backstage/commit/c371f6fe12371de31dca537510e6653e287cdc2e)
- [https://github.com/backstage/backstage](https://github.com/backstage/backstage)

## Related threats

- [Backstage scaffolder task list input validation vulnerability](https://junglewise.ai/threats/cve-2026-106506-backstage-is-an-open-framework-for-building-developer-portals)
- [Backstage scaffolder-backend sensitive information exposure in task logs](https://junglewise.ai/threats/cve-2026-106504-backstage-is-an-open-framework-for-building-developer-portals)
- [Backstage Scaffolder Backend authorization bypass in action input validation](https://junglewise.ai/threats/cve-2026-106503-backstage-is-an-open-framework-for-building-developer-portals)
- [Backstage plugin-scaffolder-backend credential exposure in task events](https://junglewise.ai/threats/cve-2026-106502-backstage-is-an-open-framework-for-building-developer-portals)
- [Backstage plugin-scaffolder-backend sensitive information exposure](https://junglewise.ai/threats/cve-2026-106501-backstage-is-an-open-framework-for-building-developer-portals)