CVE-2026-32237: @backstage/plugin-scaffolder-backend - Exposure of Default Environment Secrets via Dry-Run Endpoint
Summary
CVE-2026-32237: Impact Authenticated users with permission to execute scaffolder dry-runs can gain access to server-configured environment secrets through the dry-run API response. Affects @backstage/plugin-scaffolder-backend versions >= 3.1.0, < 3.1.5. Fixed in 3.1.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @backstage/plugin-scaffolder-backend package is a crucial component of the Backstage framework, enabling developers to create and manage software templates efficiently. It allows users to scaffold new projects and services with predefined configurations. However, this package has a vulnerability that can expose sensitive environment secrets when using the dry-run feature, which is intended for testing scaffolding without making actual changes.
Vulnerability Detail
The vulnerability arises from the dry-run API response, where authenticated users with permission to execute scaffolder dry-runs can access server-configured environment secrets. Although these secrets are redacted in log outputs, they may still be present in certain parts of the response payload. This exposure can lead to unauthorized access to sensitive information, potentially compromising the security of the application and its environment.
How To Fix
Latest published version: 4.2.1 as of 22 Oct 2026
npm install @backstage/plugin-scaffolder-backend@4.2.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.1.5
This is the first release that contains the fix.
npm install @backstage/plugin-scaffolder-backend@3.1.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can remove or empty the scaffolder.defaultEnvironment.secrets configuration from your app-config.yaml file. Additionally, consider restricting access to the scaffolder dry-run functionality through the permissions framework to mitigate the risk of exposure.
Conclusion
The vulnerability identified as CVE-2026-32237 in the @backstage/plugin-scaffolder-backend package poses a risk of exposing sensitive environment secrets through the dry-run API. It is crucial for users to update to the patched version and consider the provided workarounds to enhance security.
See every vulnerability recorded for @backstage/plugin-scaffolder-backend →
FAQ
Authenticated users can gain access to sensitive environment secrets through the dry-run API response, which could lead to unauthorized access and potential security breaches.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Update the @backstage/plugin-scaffolder-backend package to version 3.1.5 or later, and consider implementing the suggested workarounds to limit access to sensitive information.
The CVSS score of this vulnerability is 4.4, indicating a moderate level of severity.
You can refer to the official Backstage Scaffolder Backend documentation at https://backstage.io/docs/features/software-templates/ for more details.
References
Related vulnerabilities
Recent vulnerabilities recorded for @backstage/plugin-scaffolder-backend.
