CVE-2026-32237

Published: Mar 12, 2026Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

Backstage is an open framework for building developer portals. Prior to 3.1.5, authenticated users with permission to execute scaffolder dry-runs can gain access to server-configured environment secrets through the dry-run API response. Secrets are properly redacted in log output but not in all parts of the response payload. Deployments that have configured scaffolder.defaultEnvironment.secrets are affected. This is patched in @backstage/plugin-scaffolder-backend version 3.1.5.

Affected (1)

Products: Linuxfoundation: Backstage/plugin Scaffolder Backend

Linuxfoundation

1 product

Backstage/plugin Scaffolder Backend

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Linuxfoundation Backstage/plugin Scaffolder Backend	From 3.1.0 to 3.1.5

Related CWEs

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (2)

https://github.com/backstage/backstage/commit/3b62dd2d6bf7623ebd23e4b5a6dceb209f98dfce

Source: security-advisories@github.com

Patch

https://github.com/backstage/backstage/security/advisories/GHSA-8wq8-6859-qx77

Source: security-advisories@github.com

Vendor Advisory

Timeline

No history available yet.