GitHub Advisoryadvisory · npm

GHSA-8wq8-6859-qx77 @backstage/plugin-scaffolder-backend: Possible exposure of defaultEnvironment secrets using dry-run endpoint

MEDIUM Published 2026-03-12 Modified 2026-03-13 Official page ↗
Aliases
CVE-2026-32237
Ecosystem
npm
Packages
@backstage/plugin-scaffolder-backend
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-200
Reviewed
2026-03-12

Affected packages

• npm @backstage/plugin-scaffolder-backend: >= 3.1.0, < 3.1.5 → fixed in 3.1.5

Description

Impact Authenticated users with permission to execute scaffolder dry-runs can gain access to server-configured environment secrets through the dry-run API response. Secrets are properly redacted in log output but not in all parts of the response payload. Deployments that have configured `scaffolder.defaultEnvironment.secrets` are affected. ### Patches This is patched in `@backstage/plugin-scaffolder-backend` version 3.1.5 ### Workarounds Remove or empty the `scaffolder.defaultEnvironment.secrets` configuration from `app-config.yaml`. Alternatively, restrict access to the scaffolder dry-run functionality via the permissions framework. ### References • Backstage Scaffolder Backend documentation

Related

Alias · CVE (1)

  • CVE-2026-32237 Backstage is an open framework for building developer portals. vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References