# CVE-2026-29184: Backstage plugin-scaffolder-backend log redaction bypass

Source: https://junglewise.ai/threats/cve-2026-29184-backstage-plugin-scaffolder-backend-log-redaction-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-05. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-29184 · Severity: low · CVSS 3.1 · Published 2026-03-05

Backstage's scaffolder-backend is a service component that allows users to create and execute software templates for project scaffolding. A malicious template can bypass built-in safeguards that redact sensitive credentials from task logs, allowing an attacker to steal authentication tokens and other secrets. Exploitation requires the ability to register a malicious template and a user willing to execute it.

Technologies: [Backstage Plugin-Scaffolder-Backend](https://junglewise.ai/threats/technologies/plugin-scaffolder-backend), [@backstage/plugin-scaffolder-backend (npm)](https://junglewise.ai/threats/technologies/backstage-plugin-scaffolder-backend). Vendors: [Backstage](https://junglewise.ai/threats/vendors/backstage), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-29184 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-29184 being exploited in the wild.

**How severe is CVE-2026-29184?** Low severity, with a CVSS score of 3.1, published 5 March 2026.

**Which products and versions are affected?** Backstage Plugin-Scaffolder-Backend <= 3.1.3; @backstage/plugin-scaffolder-backend (npm) SEMVER:introduced=0,fixed=3.1.4.

**Is there a fix for CVE-2026-29184?** Yes. @backstage/plugin-scaffolder-backend (npm): upgrade to 3.1.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-29184 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-29184?** Check whether you run Backstage Plugin-Scaffolder-Backend or @backstage/plugin-scaffolder-backend (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @backstage/plugin-scaffolder-backend (npm): upgrade to 3.1.4 or later

  ```sh
  npm install @backstage/plugin-scaffolder-backend@3.1.4
  ```


## Technical details

The vulnerability exists in @backstage/plugin-scaffolder-backend (versions ≤ 3.1.3) as a log redaction bypass related to CWE-532 (Insertion of Sensitive Information into Log File). A malicious scaffolder template can craft task event logs in a way that circumvents the log redaction mechanism, exposing secrets such as session tokens and API credentials that would normally be filtered. The attack requires both template registration privileges and user interaction (a victim must execute the malicious template). The vulnerability is patched in version 3.1.4. Workarounds include restricting scaffolder.task.read permissions and limiting who can register templates.

## Affected products

- Backstage plugin-scaffolder-backend <= 3.1.3

## Identifiers

- CVE-2026-29184
- GHSA-8qp7-fhr9-fw53

## Timeline

- 2026-03-05: disclosed
- 2026-03-05: patched: Patched in version 3.1.4

## References

- [https://github.com/backstage/backstage/security/advisories/GHSA-8qp7-fhr9-fw53](https://github.com/backstage/backstage/security/advisories/GHSA-8qp7-fhr9-fw53)

## Related threats

- [Backstage scaffolder task list input validation vulnerability](https://junglewise.ai/threats/cve-2026-106506-backstage-is-an-open-framework-for-building-developer-portals)
- [Backstage scaffolder-backend sensitive information exposure in task logs](https://junglewise.ai/threats/cve-2026-106504-backstage-is-an-open-framework-for-building-developer-portals)
- [Backstage Scaffolder Backend authorization bypass in action input validation](https://junglewise.ai/threats/cve-2026-106503-backstage-is-an-open-framework-for-building-developer-portals)
- [Backstage plugin-scaffolder-backend credential exposure in task events](https://junglewise.ai/threats/cve-2026-106502-backstage-is-an-open-framework-for-building-developer-portals)
- [Backstage plugin-scaffolder-backend sensitive information exposure](https://junglewise.ai/threats/cve-2026-106501-backstage-is-an-open-framework-for-building-developer-portals)