CVE-2026-29184

{"id": "CVE-2026-29184", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.0, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 0.5}]}, "published": "2026-03-07T15:15:55.080", "references": [{"url": "https://github.com/backstage/backstage/security/advisories/GHSA-8qp7-fhr9-fw53", "source": "security-advisories@github.com"}], "vulnStatus": "Undergoing Analysis", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-532"}]}], "descriptions": [{"lang": "en", "value": "Backstage is an open framework for building developer portals. Prior to version 3.1.4, a malicious scaffolder template can bypass the log redaction mechanism to exfiltrate secrets provided run through task event logs. This issue has been patched in version 3.1.4."}, {"lang": "es", "value": "Backstage es un framework abierto para construir portales de desarrolladores. Antes de la versi\u00f3n 3.1.4, una plantilla de andamiaje maliciosa puede eludir el mecanismo de redacci\u00f3n de registros para exfiltrar secretos proporcionados que se ejecutan a trav\u00e9s de los registros de eventos de tareas. Este problema ha sido parcheado en la versi\u00f3n 3.1.4."}], "lastModified": "2026-03-09T13:35:34.633", "sourceIdentifier": "security-advisories@github.com"}