https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 11:25:36 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-106499 <p>Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package could expose secret-derived values in Scaffolder task logs. Deployments that configure sensitive scaffolder.defaultEnvironment.secrets and allow an attacker to create or modify Scaffolder templates are affected. A template author could cause secret-derived values used during template iteration to be persisted and exposed to users who can access the resulting task logs. This issue is fixed in version 4.1.0.</p> <p>Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package could expose secret-derived values in Scaffolder task logs. Deployments that configure sensitive scaffolder.defaultEnvironment.secrets and allow an attacker to create or modify Scaffolder templates are affected. A template author could cause secret-derived values used during template iteration to be persisted and exposed to users who can access the resulting task logs. This issue is fixed in version 4.1.0.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-106499 https://vulnerability.circl.lu/vuln/ghsa-mfvq-x7vr-rgqg <p><strong>Affected:</strong> npm: @backstage/plugin-scaffolder-backend</p> <p>### Impact</p> <p>Deployments that configure sensitive `scaffolder.defaultEnvironment.secrets` and allow an attacker to create or modify Scaffolder templates are affected. A template author could cause secret-derived values used during template iteration to be persisted in task logs, exposing those values to users with access to the resulting task logs.</p> <p>### Patches</p> <p>Patched in `@backstage/plugin-scaffolder-backend` version `4.1.0`</p> <p>### Workarounds</p> <p>- Restrict permission to create or update Template entities to fully trusted parties, as recommended by the Backstage threat model. - If that restriction cannot be guaranteed, remove sensitive values from `scaffolder.defaultEnvironment.secrets` until a patched version is available.</p> <p>No complete workaround is known that preserves both untrusted template authoring and access to sensitive default-environment secrets.</p> <p><strong>Affected:</strong> npm: @backstage/plugin-scaffolder-backend</p> <p>### Impact</p> <p>Deployments that configure sensitive `scaffolder.defaultEnvironment.secrets` and allow an attacker to create or modify Scaffolder templates are affected. A template author could cause secret-derived values used during template iteration to be persisted in task logs, exposing those values to users with access to the resulting task logs.</p> <p>### Patches</p> <p>Patched in `@backstage/plugin-scaffolder-backend` version `4.1.0`</p> <p>### Workarounds</p> <p>- Restrict permission to create or update Template entities to fully trusted parties, as recommended by the Backstage threat model. - If that restriction cannot be guaranteed, remove sensitive values from `scaffolder.defaultEnvironment.secrets` until a patched version is available.</p> <p>No complete workaround is known that preserves both untrusted template authoring and access to sensitive default-environment secrets.</p> https://vulnerability.circl.lu/vuln/ghsa-mfvq-x7vr-rgqg