CVE-2026-32237: 
JavaScript vulnerability analysis and mitigation

CVE-2026-32237 is an information disclosure vulnerability in the @backstage/plugin-scaffolder-backend npm package that allows authenticated users with scaffolder dry-run execution permissions to extract server-configured environment secrets via the dry-run API response. The vulnerability affects Backstage versions 3.1.0 through 3.1.4 (specifically the plugin-scaffolder-backend package). It was published on March 11, 2026, by maintainer benjdlambert and added to the GitHub Advisory Database on March 12, 2026. The CVSS v3.1 base score is 4.4 (Moderate) per the GitHub Security Advisory, though NVD estimates a higher score of 6.5 (GitHub Advisory, Github Advisory).

The root cause is improper handling of secret redaction in the NunjucksWorkflowRunner component (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor; CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere). When a scaffolder dry-run is executed, the runner passes this.environment?.secrets and task.secrets into the action context without checking whether the execution is a dry-run, causing secrets configured under scaffolder.defaultEnvironment.secrets in app-config.yaml to appear unredacted in portions of the API response payload. The fix, applied in commit 3b62dd2, conditionally sets both environment.secrets and task.secrets to empty objects when task.isDryRun is true, preventing secret values from being resolved and returned (GitHub Commit, GitHub Advisory).

Successful exploitation allows an authenticated attacker with scaffolder dry-run permissions to read sensitive environment secrets (e.g., cloud provider credentials such as AWS_ACCESS_KEY, API tokens, or other credentials) from the dry-run API response. Only the confidentiality dimension is impacted — there is no integrity or availability impact. Exposed credentials could enable lateral movement into cloud infrastructure, CI/CD pipelines, or other integrated services depending on the nature of the secrets configured (GitHub Advisory, Github Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.037% (11th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated user account with explicit scaffolder dry-run permissions, raising the bar for opportunistic attackers (Github Advisory, Feedly).

1. Obtain authenticated access: Log in to a Backstage instance as a user with permission to execute scaffolder dry-runs (granted via the Backstage permissions framework).
2. Identify a vulnerable version: Confirm the deployed @backstage/plugin-scaffolder-backend version is between 3.1.0 and 3.1.4 and that scaffolder.defaultEnvironment.secrets is configured in app-config.yaml.
3. Craft a dry-run template: Create or use an existing scaffolder template that references environment secrets using Nunjucks syntax, e.g., input: { secret: '${{ environment.secrets.AWS_ACCESS_KEY }}' }.
4. Invoke the dry-run API: Submit a dry-run request to the scaffolder backend API endpoint (e.g., POST /api/scaffolder/v2/tasks with isDryRun: true).
5. Extract secrets from response: Inspect the API response payload — secret values that should be redacted are returned in plaintext in the action input resolution section of the response, exposing the configured environment secrets (GitHub Advisory, GitHub Commit).

• Logs: Backstage scaffolder audit logs showing repeated dry-run API calls (POST /api/scaffolder/v2/tasks with isDryRun: true) from a single user or IP, particularly outside normal working hours or in rapid succession.
• Logs: Absence of secret values in log output (since logs correctly redact secrets) combined with API response inspection showing resolved secret values — a discrepancy that may indicate exploitation.
• Network: Unusual outbound connections from the Backstage server to external IPs shortly after dry-run API calls, potentially indicating use of exfiltrated credentials.
• Application: Scaffolder dry-run requests referencing environment.secrets.* or secrets.* template variables in the task specification payload (GitHub Advisory).

Upgrade @backstage/plugin-scaffolder-backend to version 3.1.5 or later, which patches the vulnerability by ensuring secrets are not passed into the action context during dry-run execution (GitHub Advisory). If immediate upgrade is not possible, two workarounds are available: (1) remove or empty the scaffolder.defaultEnvironment.secrets configuration from app-config.yaml, or (2) restrict access to the scaffolder dry-run functionality using the Backstage permissions framework to limit it to only fully trusted users. Organizations should also review audit logs for any prior unauthorized dry-run API access if the vulnerable version was deployed (Github Advisory).