Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Backstage is an open framework for building developer portals. Prior to 3.1.5, authenticated users with permission to execute scaffolder dry-runs can gain access to server-configured environment secrets through the dry-run API response. Secrets are properly redacted in log output but not in all parts of the response payload. Deployments that have configured scaffolder.defaultEnvironment.secrets are affected. This is patched in @backstage/plugin-scaffolder-backend version 3.1.5.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-32237 Authenticated Secret Exposure in Backstage Scaffolder Dry-Run API Before 3.1.5 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-32237
Post summary
A security vulnerability (CVE-2026-32237) involving authenticated secret exposure in Backstage Scaffolder's dry‑run API before version 3.1.5 has been identified, but no proof of concept, exploit, active exploitation, or patch details are provided.
🟠 @backstage/plugin-scaffolder-backend: Information Exposure, #CVE-2026-32237 (Moderate) https://dailycve.com/backstage-plugin-scaffolder-backend-information-exposure-cve-2026-32237-moderate/
Post summary
The tweet announces the disclosure of CVE‑2026‑32237, an information‑exposure vulnerability of moderate severity, without any mention of PoC, exploits, or patches.
CVE-2026-32237 Backstage is an open framework for building developer portals. Prior to 3.1.5, authenticated users with permission to execute scaffolder dry-runs can gain access to s… https://www.cve.org/CVERecord?id=CVE-2026-32237
Post summary
CVE-2026-32237 describes an access control flaw in Backstage for users with scaffolder dry‑run permissions before version 3.1.5; no PoC, exploit, or active exploitation is reported, but the fix is implied by the version number.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | linuxfoundation | backstage\/plugin-scaffolder-backend | - | node.js | - |