Medium · published October 7, 2026
Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package could expose secret-derived values in Scaffolder task logs. Deployments that configure sensitive scaffolder.defaultEnvironment.secrets and allow an attacker to create or modify Scaffolder templates are affected. A template author could cause secret-derived values used during template iteration to be persisted and exposed to users who can access the resulting task logs. This issue is fixed in version 4.1.0.
| Product | Versions | Fixed in |
|---|---|---|
| linuxfoundation/backstage\/plugin-scaffolder-backend | < 4.1.0 | 4.1.0 |
| linuxfoundation/backstage | < 1.54.6 | 1.54.6 |