CVE-2026-32237mediumCWE-200

CVE-2026-32237: falha de média gravidade em @backstage plugin-scaffolder-backend

@backstage/plugin-scaffolder-backend: Possible exposure of defaultEnvironment secrets using dry-run endpoint

Publicada em

Seguir esta CVE+ Monitorar plugin-scaffolder-backend+ Monitorar @backstage/plugin-scaffolder-backend

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 4.4epss 0.3%
Backstage is an open framework for building developer portals. Prior to 3.1.5, authenticated users with permission to execute scaffolder dry-runs can gain access to server-configured environment secrets through the dry-run API response. Secrets are properly redacted in log output but not in all parts of the response payload. Deployments that have configured scaffolder.defaultEnvironment.secrets are affected. This is patched in @backstage/plugin-scaffolder-backend version 3.1.5.
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
@backstage · plugin-scaffolder-backend
CVEs relacionadas — @backstage plugin-scaffolder-backend

No mesmo produto, das mais perigosas para as menos.

CVE-2026-106503HIGHBackstage: Scaffolder action input authorization bypassEPSS 0.5%CVE-2026-106501CRITICALBackstage: Sensitive information exposure in ScaffolderEPSS 0.5%CVE-2026-106500HIGHBackstage: Improper task state validation in Scaffolder backendEPSS 0.3%CVE-2026-106502MEDIUMBackstage: Sensitive information may be exposed in Scaffolder task failure eventsEPSS 0.3%CVE-2026-106499MEDIUMBackstage: Secret-derived values may be exposed in scaffolder task logsEPSS 0.3%CVE-2026-106504MEDIUMBackstage: Sensitive information exposure in scaffolder task logsEPSS 0.3%