CVE-2026-29184: Backstage plugin-scaffolder-backend log redaction bypass

CVE-2026-29184 · Severity: low · CVSS 3.1 · Published 2026-03-05

Backstage's scaffolder-backend is a service component that allows users to create and execute software templates for project scaffolding. A malicious template can bypass built-in safeguards that redact sensitive credentials from task logs, allowing an attacker to steal authentication tokens and other secrets. Exploitation requires the ability to register a malicious template and a user willing to execute it.

Technologies: Backstage Plugin-Scaffolder-Backend, @backstage/plugin-scaffolder-backend (npm). Vendors: Backstage, npm.

Quick answers

Is CVE-2026-29184 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-29184 being exploited in the wild.
How severe is CVE-2026-29184?
Low severity, with a CVSS score of 3.1, published 5 March 2026.
Which products and versions are affected?
Backstage Plugin-Scaffolder-Backend <= 3.1.3; @backstage/plugin-scaffolder-backend (npm) SEMVER:introduced=0,fixed=3.1.4.
Is there a fix for CVE-2026-29184?
Yes. @backstage/plugin-scaffolder-backend (npm): upgrade to 3.1.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-29184 attacked?
It is attacked over the network.
Am I affected by CVE-2026-29184?
Check whether you run Backstage Plugin-Scaffolder-Backend or @backstage/plugin-scaffolder-backend (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @backstage/plugin-scaffolder-backend (npm): upgrade to 3.1.4 or later
    npm install @backstage/plugin-scaffolder-backend@3.1.4

Technical details

The vulnerability exists in @backstage/plugin-scaffolder-backend (versions ≤ 3.1.3) as a log redaction bypass related to CWE-532 (Insertion of Sensitive Information into Log File). A malicious scaffolder template can craft task event logs in a way that circumvents the log redaction mechanism, exposing secrets such as session tokens and API credentials that would normally be filtered. The attack requires both template registration privileges and user interaction (a victim must execute the malicious template). The vulnerability is patched in version 3.1.4. Workarounds include restricting scaffolder.task.read permissions and limiting who can register templates.

Affected products

  • Backstage plugin-scaffolder-backend <= 3.1.3

Identifiers

  • CVE-2026-29184
  • GHSA-8qp7-fhr9-fw53

Timeline

  • 2026-03-05: disclosed
  • 2026-03-05: patched: Patched in version 3.1.4

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.