Backstage’s scaffolder task logs can reveal values that were intended to be rejected by actions because of denied permissions. A user with permission to create and read tasks can therefore read sensitive input data from those logs. The flaw results in a confidentiality breach for any data that is captured in the logs, without affecting authentication or integrity.

The vulnerability exists in the @backstage/plugin-scaffolder-backend package of Backstage deployments running any version prior to 4.1.0. It is present in environments that use scaffolder templates that include sensitive values and have restrictive action permissions. Backstage itself is also affected through the same plugin integration.

The CVSS score of 6.5 indicates a moderate severity that primarily impacts confidentiality. The EPSS score is < 1% (0.00251), which suggests a low probability of exploitation, and the issue is not listed in the CISA KEV catalog. Exploitation requires an authenticated user who can create and read tasks, and the presence of a denied action whose input contains sensitive data. The attacker does not need additional privileges beyond normal scoped permissions for task management.