CVE-2026-29184CWE-532

@backstage/plugin-scaffolder-backend: Potential Session Token Exfiltration via Log Redaction Bypass

Low · published March 7, 2026

CVSS v3.1
2.0
EPSS
0%
Percentile
21.4
In the wild
Unconfirmed
What it is

Backstage is an open framework for building developer portals. Prior to version 3.1.4, a malicious scaffolder template can bypass the log redaction mechanism to exfiltrate secrets provided run through task event logs. This issue has been patched in version 3.1.4.

The record
Technical detail
CVSS v3.1
2.0 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00299 · 21.4th percentile
Weakness
CWE-532 · Insertion of Sensitive Information into Log File
Published
2026-03-07T15:03Z
EPSS history
Timeline
  • 07 MAR 15:03Z
    @backstage/plugin-scaffolder-backend: Potential Session Token Exfiltration via Log Redaction Bypass
    cvelistv5