Executive brief
Backstage Scaffolder Backend is a plugin that manages infrastructure provisioning and templating in Backstage deployments. Authenticated users with permission to run "dry-run" tests on scaffolder templates can access server-configured environment secrets through API responses, even though these secrets are supposed to be hidden. This could expose sensitive credentials like API keys or database passwords to authorized but potentially untrusted users.
Technical details
The vulnerability is an information disclosure (CWE-200) in the dry-run API endpoint of @backstage/plugin-scaffolder-backend versions 3.1.0 through 3.1.4. When scaffolder.defaultEnvironment.secrets are configured, authenticated users with scaffolder dry-run permissions can retrieve these secrets from parts of the API response payload. While secrets are properly redacted in log output, the response object exposes them directly. The attack requires network access to the Backstage instance, valid authentication, and permission to execute scaffolder dry-runs. The vulnerability is patched in version 3.1.5.
Affected products
- Backstage plugin-scaffolder-backend 3.1.0 through 3.1.4
Timeline
- 2026-03-11: disclosed
- 2026-03-12: patched: patched in version 3.1.5