CVE-2026-29184 — LOW (2.0) — White Hats Nepal

Q: How severe is CVE-2026-29184?

CVE-2026-29184 has been rated LOW with a CVSS base score of 2.0/10. Review the CVSS metrics above for detailed severity breakdown.

Q: Is there a patch for CVE-2026-29184?

Check the references section above for vendor advisories and patch information. Affected products include: Linuxfoundation Backstage\/Plugin-Scaffolder-Backend.

Vulnerability Description

Backstage is an open framework for building developer portals. Prior to version 3.1.4, a malicious scaffolder template can bypass the log redaction mechanism to exfiltrate secrets provided run through task event logs. This issue has been patched in version 3.1.4.

CVSS Score

2.0

LOW

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality

LOW

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
Linuxfoundation	Backstage\/Plugin-Scaffolder-Backend	< 3.1.4

Related Weaknesses (CWE)

CWE-532

References

https://github.com/backstage/backstage/security/advisories/GHSA-8qp7-fhr9-fw53Vendor Advisory

FAQ

What is CVE-2026-29184?

CVE-2026-29184 is a vulnerability with a CVSS score of 2.0 (LOW). Backstage is an open framework for building developer portals. Prior to version 3.1.4, a malicious scaffolder template can bypass the log redaction mechanism to exfiltrate secrets provided run through...

How severe is CVE-2026-29184?

CVE-2026-29184 has been rated LOW with a CVSS base score of 2.0/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-29184?

Check the references section above for vendor advisories and patch information. Affected products include: Linuxfoundation Backstage\/Plugin-Scaffolder-Backend.