A malicious scaffolder template can bypass the log‑redaction mechanism in Backstage, allowing secrets such as session tokens to be written into task event logs. The vulnerability enables an attacker to exfiltrate sensitive data that should have been sanitized before logging, potentially compromising authentication tokens and other confidential information.

Backstage, the open framework for developer portals, is affected in all releases prior to version 3.1.4. The issue has been patched in 3.1.4 and later versions.

The CVSS score is 2, indicating a low severity assessment, and the EPSS score is less than 1 %, suggesting a very low probability of public exploitation. However, the vulnerability can be exploited by an attacker who can supply or modify a scaffolder template. The attack requires the ability to insert custom templates into the Backstage instance, after which the template's execution will generate event logs that contain the leaked secrets. While the immediate risk is limited, the exposure of sensitive tokens could enable further compromise if additional system access is achieved.