What is the CVSS score of CVE-2026-32237?

CVE-2026-32237 has a CVSS 3.1 base score of 4.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Backstage Plugin Scaffolder Backend are affected by CVE-2026-32237?

Organizations using access to server-configured environment secrets should be aware of moderate risk from CVE-2026-32237, a information exposure vulnerability rated CVSS 4.4.. A patch is available.

How to fix or mitigate CVE-2026-32237?

Within 30 days: Identify affected systems running access to server-configured environment secrets and apply vendor patches as part of regular patch cycle. Review data exposure and access controls.

Backstage Plugin Scaffolder Backend CVE-2026-32237

MEDIUM

Information Exposure (CWE-200)

2026-03-12 security-advisories@github.com

GHSA-8wq8-6859-qx77

Information Disclosure Backstage Plugin Scaffolder Backend

4.4

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

4.4 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

Red Hat

4.4 MEDIUM

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 19:57 vuln.today

CVE Published

Mar 12, 2026 - 19:16 nvd

MEDIUM 4.4

DescriptionGitHub Advisory

Backstage is an open framework for building developer portals. Prior to 3.1.5, authenticated users with permission to execute scaffolder dry-runs can gain access to server-configured environment secrets through the dry-run API response. Secrets are properly redacted in log output but not in all parts of the response payload. Deployments that have configured scaffolder.defaultEnvironment.secrets are affected. This is patched in @backstage/plugin-scaffolder-backend version 3.1.5.

AnalysisAI

Impact

Authenticated users with permission to execute scaffolder dry-runs can gain access to server-configured environment secrets through the dry-run API response. Secrets are properly redacted in log output but not in all parts of the response payload.

Deployments that have configured scaffolder.defaultEnvironment.secrets are affected.

Patches

This is patched in @backstage/plugin-scaffolder-backend version 3.1.5

Workarounds

Remove or empty the scaffolder.defaultEnvironment.secrets configuration from app-config.yaml. Alternatively, restrict access to the scaffolder dry-run functionality via the permissions framework.

References

Backstage Scaffolder Backend documentation

Technical ContextAI

Information disclosure occurs when an application inadvertently reveals sensitive data to unauthorized actors through error messages, logs, or improper access controls. This vulnerability is classified as Information Exposure (CWE-200).

RemediationAI

A vendor patch is available — apply it immediately. Implement proper access controls. Sanitize error messages in production. Review logging practices to avoid capturing sensitive data.