Medium severity4.4NVD Advisory· Published Mar 12, 2026· Updated Apr 30, 2026

CVE-2026-32237

Description

Backstage is an open framework for building developer portals. Prior to 3.1.5, authenticated users with permission to execute scaffolder dry-runs can gain access to server-configured environment secrets through the dry-run API response. Secrets are properly redacted in log output but not in all parts of the response payload. Deployments that have configured scaffolder.defaultEnvironment.secrets are affected. This is patched in @backstage/plugin-scaffolder-backend version 3.1.5.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
@backstage/plugin-scaffolder-backendnpm	>= 3.1.0, < 3.1.5	3.1.5

Affected products

Linux Foundation/Backstage\/plugin Scaffolder Backend
cpe:2.3:a:linuxfoundation:backstage\/plugin-scaffolder-backend:*:*:*:*:*:node.js:*:*
Range: >=3.1.0,<3.1.5
ghsa-coords
pkg:npm/%40backstage/plugin-scaffolder-backend
Range: >= 3.1.0, < 3.1.5

Patches

Vulnerability mechanics

References

github.com/backstage/backstage/commit/3b62dd2d6bf7623ebd23e4b5a6dceb209f98dfcenvdPatchWEB
github.com/advisories/GHSA-8wq8-6859-qx77ghsaADVISORY
github.com/backstage/backstage/security/advisories/GHSA-8wq8-6859-qx77nvdVendor AdvisoryWEB
nvd.nist.gov/vuln/detail/CVE-2026-32237ghsaADVISORY

News mentions

No linked articles in our index yet.

cvss	0.286
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000