The vulnerability involves a bug in the @backstage/plugin‑scaffolder‑backend component of Backstage that allows secret‑derived values to be written to scaffolder task logs. This can result in the leakage of sensitive data, such as passwords, tokens, or API keys, to any user who can view the logs. The flaw enables attackers to obtain confidential information without compromising authentication or other security controls.

Backstage and the @backstage/plugin-scaffolder-backend package are affected. Versions earlier than 4.1.0 of the plugin are vulnerable. Deployments that enable scaffolder.defaultEnvironment.secrets and give users the ability to create or modify scaffolder templates are impacted. Backstage installations that use the default scaffolder backend configuration before the 4.1.0 release should be reviewed and updated.

The CVSS score of 4.9 indicates moderate severity. No EPSS value is reported, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is via template creation or modification, requiring an attacker to have permissions to add or edit scaffolder templates. Because the issue only exposes logged data and does not allow arbitrary code execution, exploitability largely depends on the deployment's access controls. Treat the exposure of secrets as a policy concern and apply the official fix promptly.