TI-2025-34942 Aliases CVE-2025-55285 GHSA-3x3q-ghcp-whf7

@backstage/plugin-scaffolder-backend Template Secret Leakage in Logs in Scaffolder When Using `fetch:template`

LOW 13CWE-532Published 2025-08-15 · Updated 2025-08-15

Key facts

Attack vector: Network
Privileges required: High
User interaction: Required
Attack complexity: High
Impact type: Information disclosure
Confidentiality · integrity · availability: Low · None · None
Fix status: Partial Red Hat: 2 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-532.

Summary

@backstage/plugin-scaffolder-backend is the backend for the default Backstage software templates. Prior to version 2.1.1, duplicate logging of the input values in the fetch:template action in the Scaffolder meant that some of the secrets were not properly redacted. If ${{ secrets.x }} is not passed through to fetch:template there is no impact. This issue has been resolved in 2.1.1 of the scaffolder-backend plugin. A workaround for this issue involves Template Authors removing the use of ${{ secrets }} being used as an argument to fetch:template.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00262 18th percentileScored 2026-11-07

Fix Partial backstage (backstage): 2.1.1@backstage/plugin-scaffolder-backend (npm): 2.1.1Red Hat: 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
backstage	backstage	before 2.1.1	2.1.1	Patch available	CNA
—	@backstage/plugin-scaffolder-backend (npm)	before 2.1.1	2.1.1	Patch available	GHSA-3x3q-ghcp-whf7

backstage Vendorbackstage Affected before 2.1.1 Fixed in 2.1.1 Patch available CNA
@backstage/plugin-scaffolder-backend (npm) Vendor— Affected before 2.1.1 Fixed in 2.1.1 Patch available GHSA-3x3q-ghcp-whf7

Remediation

Fix · CNA backstage (backstage) Fixed in 2.1.1
Fix · GHSA-3x3q-ghcp-whf7 @backstage/plugin-scaffolder-backend (npm) Fixed in 2.1.1 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

Product	Status	Plan or fix
OpenShift Serverless	Affected	No fix yet: Fix deferred
Red Hat Developer Hub 1	Affected	No fix yet: Fix deferred

Timeline

2026-10-02 Threatist record created from CVE-2025-55285
2026-10-03 Alias added: GHSA-3x3q-ghcp-whf7
2026-10-27 Affected versions changed · Red Hat

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2025-55285

Other 3

TI-2026-33119 Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys KEVCVSS 3.1CRITICAL 9.6
TI-2018-10499 Integer overflow in backstage kernel KEVCVSS 3.0HIGH 7.8
TI-2024-08998 Remote Code Execution in kedro-org/kedro CVSS 3.0CRITICAL 9.8
TI-2023-12294 Dragonfly2 vulnerable to hard coded cyptographic key CVSS 3.1CRITICAL 9.8
TI-2021-12074 Authentication vulnerability in MOSN v.0.23.0 allows attacker to escalate privileges via… CVSS 3.1CRITICAL 9.8
TI-2019-04061 runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows… CVSS 3.1HIGH 8.6

See all 662 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences