Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Backstage is an open framework for building developer portals. Prior to version 3.1.4, a malicious scaffolder template can bypass the log redaction mechanism to exfiltrate secrets provided run through task event logs. This issue has been patched in version 3.1.4.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-03-07 | 2 | Disclosure2 |
| 2026-08-27 | 1 | Patch1 |
CVE-2026-29184 Backstage Secret Exfiltration via Malicious Scaffolder Template Before 3.1.4 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-29184
Post summary
The text announces CVE-2026-29184, highlighting that secret exfiltration can occur via a malicious scaffolder template in Backstage versions prior to 3.1.4, with a link to additional details.
🛡️ SharePoint Server — autenticación débil (CVE-2026-29184) Impacto: un atacante remoto puede explotar una debilidad en la autenticación de SharePoint Server, con un CVSS de8.2. La vulnerabilidad permite acceso no autorizado a datos sensibles. Estado: parchada en las actualizaciones de seguridad de agosto de2026. Microsoft clasificó la vulnerabilidad como "importante" y recomienda actualización inmediata. Acción hoy: 1. Aplicar las actualizaciones de seguridad de agosto de2026 en todos los servidores SharePoint. 2. Revisar permisos de acceso y auditoría de datos sensibles. 3. Verificar que no haya accesos no autorizados a sitios de SharePoint. Un SharePoint débil en autenticación es el tipo de vulnerabilidad que convierte un repositorio de documentos en un buffet abierto. Sigue a @Soy_Nube_Negra si te sirve este tipo de análisis. https://www.microsoft.com/en-us/security/msrc/advisory/CVE-2026-29184
Post summary
CVE‑2026‑29184 is an authentication flaw in SharePoint Server with a CVSS score of 8.2, already patched in Microsoft’s August 2026 security updates; administrators should immediately apply the update and review access controls.
CVE-2026-29184 Backstage is an open framework for building developer portals. Prior to version 3.1.4, a malicious scaffolder template can bypass the log redaction mechanism to exfil… https://www.cve.org/CVERecord?id=CVE-2026-29184
Post summary
The post discloses CVE‑2026‑29184, noting that a malicious scaffolder template can bypass Backstage’s log redaction mechanism leading to data exfiltration before version 3.1.4, but it lacks proof‑of‑concept details or evidence of active exploitation.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | linuxfoundation | backstage\/plugin-scaffolder-backend | - | - | - |