Plugin scaffolder backend: Backstage: Secret-derived values may be exposed in scaffolder task logs (CVE-2026-106499)

The vulnerability (CVE-2026-106499) affects deployments of @backstage/plugin-scaffolder-backend that use sensitive secrets in scaffolder.defaultEnvironment.secrets and permit attackers to create or modify Scaffolder templates. An attacker with template authoring permissions can cause secret-derived values used during template iteration to be logged in task logs, exposing these secrets to any user who can view the logs. This issue is patched in version 4.1.0 of the plugin.

Secret-derived values intended to be confidential may be exposed in task logs, leading to potential unauthorized disclosure of sensitive information. The exposure requires that an attacker has permission to create or modify Scaffolder templates and that users have access to the resulting task logs. The confidentiality impact is high, but there is no impact on integrity or availability.

A patch is available in @backstage/plugin-scaffolder-backend version 4.1.0 and should be applied. Until patched, restrict permissions to create or update Template entities to fully trusted parties as recommended by the Backstage threat model. If this restriction cannot be guaranteed, remove sensitive values from scaffolder.defaultEnvironment.secrets. No complete workaround exists that allows untrusted template authoring while preserving access to sensitive default-environment secrets.