CVE-2026-29184 — @backstage/plugin-scaffolder-backend: Potential Session Token Exfiltration via Log Redaction Bypass

CVE-2026-29184

@backstage/plugin-scaffolder-backend: Potential Session Token Exfiltration via Log Redaction Bypass PUBLISHED

Description (CNA)

Backstage is an open framework for building developer portals. Prior to version 3.1.4, a malicious scaffolder template can bypass the log redaction mechanism to exfiltrate secrets provided run through task event logs. This issue has been patched in version 3.1.4.

Affected (CNA)

Vendor / product	Versions
backstage / backstage	affected < 3.1.4

CWE

CWE-532

References

https://github.com/backstage/backstage/security/advisories/GHSA-8qp7-fhr9-fw53

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.