Backstage is an open framework for building developer portals. Prior to version 3.1.5, an authenticated user with permission to execute scaffolder dry‑runs can gain access to server‑configured environment secrets via the dry‑run API response; the payload does not fully redact secrets, which can expose sensitive data. This flaw represents a information disclosure weakness (CWE‑200) and a related data handling issue (CWE‑497).

The affected product is @backstage:plugin-scaffolder-backend. All deployments using a version prior to 3.1.5 that have configured scaffolder.defaultEnvironment.secrets are impacted. The common platform enumeration string for the affected platform is cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*.*

The CVSS score of 4.4 indicates moderate severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploit requires authentication and permission to run dry‑runs, and is limited to the specific configured environment secrets of the deployment. The official fix is included in version 3.1.5 of the plugin, which fully redacts secrets from the dry‑run response.