CVE-2026-32237: @backstage/plugin-scaffolder-backend: Possible exposure of defaultEnvironment secrets using dry-run endpoint

March 12, 2026 (updated March 13, 2026)

Authenticated users with permission to execute scaffolder dry-runs can gain access to server-configured environment secrets through the dry-run API response. Secrets are properly redacted in log output but not in all parts of the response payload.

Deployments that have configured scaffolder.defaultEnvironment.secrets are affected.

References

github.com/advisories/GHSA-8wq8-6859-qx77
github.com/backstage/backstage
github.com/backstage/backstage/commit/3b62dd2d6bf7623ebd23e4b5a6dceb209f98dfce
github.com/backstage/backstage/security/advisories/GHSA-8wq8-6859-qx77
nvd.nist.gov/vuln/detail/CVE-2026-32237

Code Behaviors & Features

Detect and mitigate CVE-2026-32237 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →