Backstage EUVD-2026-94057

Exploitation requires a specific non-default configuration AND privileged access. First, the deployment must populate sensitive values in scaffolder.defaultEnvironment.secrets (without configured secrets there is nothing to leak). Second, the attacker must already hold the privileged capability to create or modify Scaffolder templates (reflected as PR:H). Third, the malicious template must use secret-derived values inside an 'each' iteration where the value is passed through a transforming Nunjucks filter (e.g. upper, replace, or a custom filter such as toSecretKeyedObject), because untransformed secrets were already redacted - only transformed/derived forms escaped redaction. Finally, a reader must have access to the resulting task logs to actually obtain the value. Limiting factors: no anonymous/unauthenticated path, requires trusted template-author role, requires secrets to be configured at all, and requires log-read access - making realistic risk substantially lower than the C:H rating alone suggests.

This is a genuinely moderate, hard-to-exploit information-disclosure issue rather than a high-urgency flaw, and the signals are consistent in pointing that way. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, base 4.9 MEDIUM) shows high confidentiality impact but gated behind PR:H - the attacker must already hold the privileged ability to author or modify Scaffolder templates, which in most Backstage deployments is a trusted role. No EPSS score, KEV listing, or POC was provided in the intelligence, so there is no evidence of active or probable exploitation; exploitation status is 'no public exploit identified at time of analysis.' Two conditions must BOTH hold: the deployment must configure real secrets in scaffolder.defaultEnvironment.secrets, AND an attacker must already be a (malicious or compromised) template author, AND finally a victim must be able to read the resulting task logs. The high-privilege precondition plus the non-default secret configuration requirement sharply narrow real-world exposure despite the C:H rating. This should be patched on a normal maintenance cadence, not treated as an emergency. One versioning nuance to verify: the description says 'prior to 4.1.0 / fixed in 4.1.0' (the @backstage/plugin-scaffolder-backend package version), while the NVD reference points to release tag v1.54.6 (the umbrella Backstage release) - these are not conflicting, they are two different version namespaces, but operators should confirm which they track.

A user with Scaffolder template-authoring rights in a Backstage instance that has secrets configured under scaffolder.defaultEnvironment.secrets writes a template that iterates (via an 'each' loop) over a secret value passed through a transforming filter such as upper or replace. Because transformed secret-derived values were not redacted, the resolved secret is persisted into the Scaffolder task log, where any user able to view that task's logs can read it. No public exploit code was identified in the provided intelligence; the fix in 4.1.0 extends log redaction to these transformed iteration values.