CVE-2026-32237: Linuxfoundation Backstage/plugin-Scaffolder-Backend

Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days.

Backstage is an open framework for building developer portals. Prior to 3.1.5, authenticated users with permission to execute scaffolder dry-runs can gain access to server-configured environment secrets through the dry-run API response. Secrets are properly redacted in log output but not in all parts of the response payload. Deployments that have configured scaffolder.defaultEnvironment.secrets are affected. This is patched in @backstage/plugin-scaffolder-backend version 3.1.5.

Affected products

• Linuxfoundation Backstage/plugin-Scaffolder-Backend: from 3.1.0, before 3.1.5 (fixed in 3.1.5)

Published 2026-03-12. Last modified 2026-06-17.