Executive brief
Backstage's scaffolder-backend is a service component that allows users to create and execute software templates for project scaffolding. A malicious template can bypass built-in safeguards that redact sensitive credentials from task logs, allowing an attacker to steal authentication tokens and other secrets. Exploitation requires the ability to register a malicious template and a user willing to execute it.
Technical details
The vulnerability exists in @backstage/plugin-scaffolder-backend (versions ≤ 3.1.3) as a log redaction bypass related to CWE-532 (Insertion of Sensitive Information into Log File). A malicious scaffolder template can craft task event logs in a way that circumvents the log redaction mechanism, exposing secrets such as session tokens and API credentials that would normally be filtered. The attack requires both template registration privileges and user interaction (a victim must execute the malicious template). The vulnerability is patched in version 3.1.4. Workarounds include restricting scaffolder.task.read permissions and limiting who can register templates.
Affected products
- Backstage plugin-scaffolder-backend <= 3.1.3
Timeline
- 2026-03-05: disclosed
- 2026-03-05: patched: Patched in version 3.1.4