🛡️ CVE-2026-29184 — plugin-scaffolder-backend

🟢 CVSS 2.0 — Low ✅ No Known Exploit CWE-532 NVD
2.0
CVSS Score
0 Low4 Medium7 High9 Critical10

Description

@backstage/plugin-scaffolder-backend Vulnerable to Potential Session Token Exfiltration via Log Redaction Bypass

Impact

A malicious scaffolder template can bypass the log redaction mechanism to exfiltrate secrets provided run through task event logs.

The attack requires:

  • The ability to register a template in the catalog
  • A victim who executes the malicious template

Patches

Patched in @backstage/plugin-scaffolder-backend version 3.1.4

Workarounds

  • Implement a custom permission policy that restricts scaffolder.task.read so users can only read their own task logs
  • Restrict who can register templates in the catalog to trusted users only

Resources

  • Backstage Scaffolder permissions documentation: https://backstage.io/docs/permissions/plugin-authors/01-setup/
  • Backstage Threat Model: https://backstage.io/docs/overview/threat-model/

How this vulnerability can be exploited

This issue can be reached over the network, attack complexity is high, an attacker needs administrative privileges on the target. A user must be tricked into taking some action. The scope is unchanged, so the impact stays within the vulnerable component. Rated impact: confidentiality low, integrity none, availability none.

Weakness class

CVE-2026-29184 is classified as CWE-532: Insertion of Sensitive Information into Log File. Sensitive values are written to logs, which are typically kept longer and read more widely than the data warrants.

Affected software

CVE-2026-29184 is recorded against 2 packages.

  • @backstage/plugin-scaffolder-backend
  • backstage\/plugin-scaffolder-backend (fixed in 3.1.4)

Timeline and source

Published on 5 March 2026 and last revised on 9 March 2026. No public exploit is currently recorded for this entry. Record sourced from NVD.

References

github.com (Web)
nvd.nist.gov (Advisory)
backstage.io (Web)
backstage.io (Web)
github.com (Package)

Details

Severity LOW
CVSS Score 2.0
CVSS Vector CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N
CWE CWE-532
Public Exploit ✅ No
Source NVD
Published 2026-03-05
Updated 2026-08-12
Modified 2026-03-09
Fix URL N/A

Affected Packages

Software From version Fixed in
@backstage/plugin-scaffolder-backend — —
backstage\/plugin-scaffolder-backend — 3.1.4

Similar Threats

Free Vulnerability Check

Is your site affected by CVE-2026-29184?

BotEraser helps you identify potentially vulnerable plugins and themes by checking your installation against CVE-2026-29184 and other known CVE records.

Scan My Site Free →

No credit card required  ·  Results in minutes

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.