CVE-2026-29184: 
JavaScript vulnerability analysis and mitigation

CVE-2026-29184 is a log redaction bypass vulnerability in the @backstage/plugin-scaffolder-backend npm package that allows a malicious scaffolder template to exfiltrate secrets through task event logs. It affects all versions up to and including 3.1.3, with the fix introduced in version 3.1.4. The vulnerability was published on March 4, 2026, by benjdlambert and added to the GitHub Advisory Database on March 5, 2026. The GitHub Advisory assigns a CVSS v3.1 score of 2.0 (Low) with vector CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N, while Feedly's aggregated data reflects a higher estimate of 6.5 (Medium) (GitHub Advisory, Backstage Advisory).

The root cause is classified as CWE-532 (Insertion of Sensitive Information into Log File): the scaffolder backend's log redaction mechanism can be bypassed by a crafted template, causing secrets passed during task execution to appear in plaintext within task event logs (GitHub Advisory). Exploitation requires two preconditions: the attacker must have the ability to register a malicious template in the Backstage catalog, and a victim user must execute that template. Because task event logs may be readable by other users (depending on permission configuration), the bypassed redaction allows the attacker to later read the exposed secrets from those logs (Backstage Advisory).

Successful exploitation results in confidentiality loss: secrets (such as session tokens or other credentials) provided during scaffolder task execution are written in unredacted form to task event logs, where they may be read by the attacker or other unauthorized users with access to scaffolder.task.read. There is no integrity or availability impact. The scope of exposure is limited to secrets used within the affected scaffolder task, but depending on the nature of those secrets, downstream systems could be at risk (GitHub Advisory, Backstage Advisory).

There is no known public exploit code or evidence of in-the-wild exploitation for CVE-2026-29184. The EPSS score is approximately 0.01% (1st percentile), indicating a very low probability of exploitation in the near term (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires high privileges (template registration rights) and user interaction, significantly limiting the practical attack surface.

1. Gain template registration access: The attacker must obtain or already possess the ability to register a new scaffolder template in the Backstage catalog (requires elevated privileges or a misconfigured catalog registration policy).
2. Craft a malicious template: Create a scaffolder template designed to bypass the log redaction mechanism — for example, by structuring secret references or output steps in a way that causes the backend to log secret values in plaintext rather than redacting them.
3. Register the template: Add the malicious template to the Backstage catalog so it appears as a legitimate option for users.
4. Wait for victim execution: A victim user with access to secrets (e.g., session tokens, API keys) executes the malicious template, triggering the scaffolder task.
5. Read task event logs: The attacker accesses the task event logs (via scaffolder.task.read permissions or by exploiting overly permissive log access) to retrieve the unredacted secrets written during the task run (GitHub Advisory, Backstage Advisory).

• Logs: Task event logs in the Backstage scaffolder backend containing plaintext secrets, tokens, or credentials that should normally appear redacted (e.g., *** replaced by actual values).
• Catalog: Presence of unfamiliar or recently registered scaffolder templates in the catalog, especially those with unusual step configurations involving secret parameters or output logging.
• Access Patterns: Unexpected or repeated access to scaffolder task logs (scaffolder.task.read) by users who did not execute the corresponding task, particularly shortly after task completion.

Upgrade @backstage/plugin-scaffolder-backend to version 3.1.4 or later, which contains the fix for the log redaction bypass (GitHub Advisory). If immediate upgrade is not possible, two workarounds are available: (1) implement a custom permission policy that restricts scaffolder.task.read so users can only read their own task logs, and (2) restrict who can register templates in the catalog to trusted users only (Backstage Advisory).

The advisory was published by benjdlambert of the Backstage project on March 4, 2026, and reviewed by the GitHub Advisory Database on March 5, 2026. No significant broader media coverage or notable external researcher commentary has been identified for this vulnerability. The Backstage project references its own threat model and permissions documentation as context for the issue (Backstage Advisory).