CVE-2026-32237: @backstage/plugin-scaffolder-backend: Possible exposure of defaultEnvironment secrets using dry-run endpoint
Impact Authenticated users with permission to execute scaffolder dry-runs can gain access to server-configured environment secrets through the dry-run API response. Secrets are properly redacted in log output but not in all parts of the response payload. Deployments that have configured scaffolder.defaultEnvironment.secrets are affected. ### Patches
This is patched in @backstage/plugin-scaffolder-backend version 3.1.5 ### Workarounds
Remove or empty the scaffolder.defaultEnvironment.secrets configuration from app-config.yaml. Alternatively, restrict access to the scaffolder dry-run functionality via the permissions framework.
### References
- Backstage Scaffolder Backend documentation
Other sources
Backstage is an open framework for building developer portals. Prior to 3.1.5, authenticated users with permission to execute scaffolder dry-runs can gain access to server-configured environment secrets through the dry-run API response. Secrets are properly redacted in log output but not in all parts of the response payload. Deployments that have configured scaffolder.defaultEnvironment.secrets are affected. This is patched in @backstage/plugin-scaffolder-backend version 3.1.5.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-32237?
CVE-2026-32237 has a high severity rating due to the risk of authenticated users executing unauthorized scaffolder dry-runs.
How do I fix CVE-2026-32237?
To fix CVE-2026-32237, update the @backstage/plugin-scaffolder-backend package to version 3.1.6 or later.
What systems are affected by CVE-2026-32237?
CVE-2026-32237 affects the @backstage/plugin-scaffolder-backend version 3.1.0 to 3.1.5.
Who is vulnerable to CVE-2026-32237?
Authenticated users with permission to execute scaffolder dry-runs are vulnerable to CVE-2026-32237.
What is the nature of the vulnerability in CVE-2026-32237?
CVE-2026-32237 allows authenticated users to exploit permissions related to scaffolder dry-runs.