CVE-2026-32237 Details
Description
Backstage is an open framework for building developer portals. Prior to 3.1.5, authenticated users with permission to execute scaffolder dry-runs can gain access to server-configured environment secrets through the dry-run API response. Secrets are properly redacted in log output but not in all parts of the response payload. Deployments that have configured scaffolder.defaultEnvironment.secrets are affected. This is patched in @backstage/plugin-scaffolder-backend version 3.1.5.
A vulnerability exists in Backstage versions prior to 3.1.5, specifically within the Scaffolder backend plugin. Authenticated users with permission to execute scaffolder dry-runs can inadvertently access server-configured environment secrets through the dry-run API response. While these secrets are correctly redacted in the log output, they remain visible in certain parts of the response payload. This issue affects deployments that have the 'scaffolder.defaultEnvironment.secrets' configuration enabled.
Users can upgrade to '@backstage/plugin-scaffolder-backend' version 3.1.5 or later to address this vulnerability. Alternatively, remove or empty the 'scaffolder.defaultEnvironment.secrets' configuration from 'app-config.yaml', or restrict access to the scaffolder dry-run functionality through the permissions framework.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 12, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linuxfoundation backstage/plugin-scaffolder-backend | >= 3.1.0, < 3.1.5 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 30, 2026 | Reanalysis | [email protected] |
| Mar 19, 2026 | Initial Analysis | [email protected] |
| Mar 12, 2026 | New CVE Received | [email protected] |