Vulnerability Report

CVE-2026-32237

Title: Scaffolder Dry-Run Environment Secret Disclosure

Information Disclosure

Proof Of Concept

No public PoC currently indexed for CVE-2026-32237.

CWE Category CWE-200

Published Date Mar 12, 2026

Modified Date Apr 30, 2026

Exploit Status Not Found

Score 4.4 CVSS v3.1

Exploit Probability (EPSS)

0.04%

Vulnerability Summary

CVE-2026-32237: Backstage is an open framework for building developer portals. Prior to 3.1.5, authenticated users with permission to execute scaffolder dry-runs can gain access to server-configured environment secrets through the dry-run API response. Secrets are properly redacted in log output but not in all parts of the response payload. Deployments that have configured scaffolder.defaultEnvironment.secrets are affected. This is patched in @backstage/plugin-scaffolder-backend version 3.1.5.

Impacted Vendors

linuxfoundation 2

Reference Links

https://github.com/backstage/backstage/commit/3b62dd2d6bf7623ebd23e4b5a6dceb209f98dfce https://github.com/backstage/backstage/security/advisories/GHSA-8wq8-6859-qx77

CVSS v3.1

Source Entity [email protected]

Severity MEDIUM

4.4

Attack Vector

NETWORK

Complexity

HIGH

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

UNCHANGED

RAW VECTOR CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

CVSS v3.1

Source Entity [email protected]

Severity MEDIUM

6.5

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

UNCHANGED

RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2026-32237 Exploits & PoCs (Proof Of Concept)

No public PoCs found in our database for this CVE.

April 30, 2026 MODIFIED

Vulnerability data updated via NVD.

March 19, 2026 MODIFIED

Vulnerability data updated via NVD.

March 12, 2026 MODIFIED

Vulnerability data updated via NVD.

March 12, 2026 MODIFIED

Vulnerability data updated via NVD.

Attack Vector Matrix

Access Vector NETWORK

Complexity HIGH

Privileges N/A

Interaction NONE

CVSS Vector String


                                    CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

Affected Stack

No specific products linked.