CVE-2026-32237

The record

Backstage is an open framework for building developer portals. Prior to 3.1.5, authenticated users with permission to execute scaffolder dry-runs can gain access to server-configured environment secrets through the dry-run API response. Secrets are properly redacted in log output but not in all parts of the response payload. Deployments that have configured scaffolder.defaultEnvironment.secrets are affected. This is patched in @backstage/plugin-scaffolder-backend version 3.1.5.

Affected packages

Related vulnerabilities

• GHSA-8wq8-6859-qx77 @backstage/plugin-scaffolder-backend: Possible exposure of defaultEnvironment secrets… Same vulnerability
• CVE-2026-29184 Backstage is an open framework for building developer portals. Also affects @backstage/plugin-scaffolder-backend
• GHSA-8qp7-fhr9-fw53 @backstage/plugin-scaffolder-backend Vulnerable to Potential Session Token Exfiltration… Also affects @backstage/plugin-scaffolder-backend
• CVE-2026-24046 Backstage is an open framework for building developer portals. Also affects @backstage/plugin-scaffolder-backend
• GHSA-rq6q-wr2q-7pgp Backstage has a Possible Symlink Path Traversal in Scaffolder Actions Also affects @backstage/plugin-scaffolder-backend
• CVE-2026-114657 Grav from 2.0.0 before 2.2.5 contains an information disclosure vulnerability that allows… CWE-200
• CVE-2026-114574 A security vulnerability has been detected in massCodeIO massCode 5.10. CWE-200
• CVE-2026-111756 follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows… CWE-200