{"action":"Upgrade @backstage/plugin-scaffolder-backend to 3.1.4 or later.","affected":[{"fixed":"3.1.4","introduced":"0"}],"component":"@backstage/plugin-scaffolder-backend","cve_ids":["CVE-2026-29184"],"ecosystem":"npm","epss":0.00299,"exploited":false,"fixed_versions":["3.1.4"],"ghsa_id":"GHSA-8qp7-fhr9-fw53","id":"tcs_01M5KFDSBS0GCZPCDS984ZDS31","modified_at":"2026-03-09T16:02:10.503918Z","published_at":"2026-03-05T00:23:51Z","references":["https://osv.dev/vulnerability/GHSA-8qp7-fhr9-fw53","https://github.com/backstage/backstage/security/advisories/GHSA-8qp7-fhr9-fw53","https://nvd.nist.gov/vuln/detail/CVE-2026-29184","https://backstage.io/docs/overview/threat-model","https://backstage.io/docs/permissions/plugin-authors/01-setup","https://github.com/backstage/backstage"],"severity":{"label":"low","score":2},"sources":[{"source":"osv","source_id":"GHSA-8qp7-fhr9-fw53","url":"https://osv.dev/vulnerability/GHSA-8qp7-fhr9-fw53"}],"summary":"@backstage/plugin-scaffolder-backend Vulnerable to Potential Session Token Exfiltration via Log Redaction Bypass"}