PT-2026-25053 · Npm+3 · @Backstage/Plugin-Scaffolder-Backend+2

Benjdlambert · Published 2026-03-12 · Updated 2026-04-30 · CVE-2026-32237

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 3.1.5

Description Backstage is an open framework for building developer portals. Authenticated users with permission to execute scaffolder dry-runs can gain access to server-configured environment secrets through the dry-run API response. Secrets are properly redacted in log output but not in all parts of the response payload. Deployments that have configured scaffolder.defaultEnvironment.secrets are affected. The API endpoint involved is the dry-run API. The vulnerable configuration is scaffolder.defaultEnvironment.secrets.

Recommendations Versions prior to 3.1.5 should be updated to version 3.1.5 or later. Remove or empty the scaffolder.defaultEnvironment.secrets configuration from app-config.yaml. Alternatively, restrict access to the scaffolder dry-run functionality via the permissions framework.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-32237

GHSA-8WQ8-6859-QX77

Affected Products

@Backstage/Plugin-Scaffolder-Backend

Backstage

Plugin-Scaffolder-Backend

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32237.json · Exploit
• https://github.com/backstage/backstage/commit/3b62dd2d6bf7623ebd23e4b5a6dceb209f98dfce · Patch
• https://github.com/backstage/backstage/security/advisories/GHSA-8wq8-6859-qx77 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32237 · Security Note
• https://osv.dev/vulnerability/GHSA-8wq8-6859-qx77 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-32237 · Vendor Advisory
• https://github.com/backstage/backstage · Note
• https://twitter.com/CVEnew/status/2032230671238795427 · Twitter Post
• https://t.me/cveNotify/161609 · Telegram Post
• https://twitter.com/dailycve/status/2032231535525392493 · Twitter Post