Most recent entries from all

EUVD-2026-249985

fkie_cve-2025-55285

@backstage/plugin-scaffolder-backend is the backend for the default Backstage software templates. Prior to version 2.1.1, duplicate logging of the input values in the fetch:template action in the Scaffolder meant that some of the secrets were not properly redacted. If ${{ secrets.x }} is not passed through to fetch:template there is no impact. This issue has been resolved in 2.1.1 of the scaffolder-backend plugin. A workaround for this issue involves Template Authors removing the use of ${{ secrets }} being used as an argument to fetch:template.

GHSA-3x3q-ghcp-whf7 — Template Secret leakage in logs in Scaffolder when using `fetch:template`

Affected: npm: @backstage/plugin-scaffolder-backend

A logging flaw in Backstage Scaffolder’s `fetch:template` action up to `@backstage/plugin-scaffolder-backend` **2.1.0** may write template secrets to logs. The action emitted a duplicate, pre-redaction copy of input parameters, so values provided via the `{{ secrets }}` bag could appear in local/server logs when the action ran. Exploitation requires use of the `secrets` argument and access to Scaffolder/build logs; integrity and availability are unaffected.

* **Fix:** upgrade to `2.1.1`, which removes the duplicate log path and ensures secrets are redacted. * **Mitigation:** avoid passing `{{ secrets }}` to `fetch:template` if upgrade is not possible.

> Open an issue in the [Backstage repository](https://github.com/backstage/backstage) > > Visit our Discord, linked to in [Backstage README](https://github.com/backstage/backstage)