Backstage’s scaffolder backend could expose sensitive credentials in Scaffolder task failure events. When certain templates failed, an authenticated user could retrieve backend‑managed credentials that were used during execution, compromising confidentiality. This flaw is identified as CWE‑209 – Information Exposure.

The vulnerability affects the Backstage framework, specifically the @backstage/plugin-scaffolder-backend package. Versions older than 4.1.0 are impacted. Users running earlier releases of the Backstage ecosystem need to update to a patched version to avoid the data leak.

The CVSS score of 5.3 indicates a moderate severity. The EPSS score is < 1%, and the issue is not listed as a known exploited vulnerability. The attack is feasible for an authenticated user who can trigger a task failure under the specified conditions, enabling the extraction of stored credentials from the failure event logs.