CVE-2026-29184: @backstage/plugin-scaffolder-backend Vulnerable to Session Token Exfiltration via Log Redaction Bypass
Summary
CVE-2026-29184: Impact A malicious scaffolder template can bypass the log redaction mechanism to exfiltrate secrets provided run through task event logs. Affects @backstage/plugin-scaffolder-backend versions < 3.1.4. Fixed in 3.1.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @backstage/plugin-scaffolder-backend is a plugin for the Backstage platform, which is designed to facilitate the creation and management of software templates. It allows developers to scaffold new projects quickly and efficiently. However, this plugin has a vulnerability that can be exploited if malicious templates are registered, leading to potential exposure of sensitive information.
Vulnerability Detail
The vulnerability arises from a flaw in the log redaction mechanism of the @backstage/plugin-scaffolder-backend. A malicious scaffolder template can bypass this mechanism, allowing it to exfiltrate secrets that are logged during task execution. This requires an attacker to register a malicious template in the catalog and for a victim to execute it, potentially leading to unauthorized access to sensitive session tokens and other secrets.
How To Fix
Latest published version: 4.2.1 as of 22 Oct 2026
npm install @backstage/plugin-scaffolder-backend@4.2.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.1.4
This is the first release that contains the fix.
npm install @backstage/plugin-scaffolder-backend@3.1.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
To mitigate the risk while waiting for the patch, implement a custom permission policy that restricts access to task logs. For example, you can configure the permissions so that users can only read their own task logs. Additionally, restrict the ability to register templates in the catalog to trusted users only.
Conclusion
The @backstage/plugin-scaffolder-backend has a vulnerability that allows for potential session token exfiltration through a log redaction bypass. It is crucial to update to the patched version 3.1.4 or implement the suggested workarounds to mitigate risks associated with this vulnerability.
See every vulnerability recorded for @backstage/plugin-scaffolder-backend →
FAQ
CVE-2026-29184 is a vulnerability in the @backstage/plugin-scaffolder-backend that allows malicious templates to bypass log redaction and exfiltrate sensitive information.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which analyzes your package-lock.json for vulnerabilities.
If exploited, this vulnerability could lead to unauthorized access to sensitive session tokens and other secrets logged during task execution.
You can implement a custom permission policy in your Backstage configuration to restrict access to task logs and limit template registration to trusted users.
Yes, the vulnerability has been patched in version 3.1.4 of the @backstage/plugin-scaffolder-backend. Updating to this version will resolve the issue.
References
Related vulnerabilities
Recent vulnerabilities recorded for @backstage/plugin-scaffolder-backend.
