https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-08T11:25:36.429145+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2026-106499 fkie_cve-2026-106499 2026-10-08T11:25:36.431079+00:00

Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package could expose secret-derived values in Scaffolder task logs. Deployments that configure sensitive scaffolder.defaultEnvironment.secrets and allow an attacker to create or modify Scaffolder templates are affected. A template author could cause secret-derived values used during template iteration to be persisted and exposed to users who can access the resulting task logs. This issue is fixed in version 4.1.0.

 https://vulnerability.circl.lu/vuln/ghsa-mfvq-x7vr-rgqg GHSA-mfvq-x7vr-rgqg — Backstage: Secret-derived values may be exposed in scaffolder task logs 2026-10-08T11:25:36.431169+00:00

Affected: npm: @backstage/plugin-scaffolder-backend

### Impact

Deployments that configure sensitive `scaffolder.defaultEnvironment.secrets` and allow an attacker to create or modify Scaffolder templates are affected. A template author could cause secret-derived values used during template iteration to be persisted in task logs, exposing those values to users with access to the resulting task logs.

### Patches

Patched in `@backstage/plugin-scaffolder-backend` version `4.1.0`

### Workarounds

- Restrict permission to create or update Template entities to fully trusted parties, as recommended by the Backstage threat model. - If that restriction cannot be guaranteed, remove sensitive values from `scaffolder.defaultEnvironment.secrets` until a patched version is available.

No complete workaround is known that preserves both untrusted template authoring and access to sensitive default-environment secrets.