4.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-32237

CVE-2026-32237: @backstage/plugin-scaffolder-backend: Possible exposure of defaultEnvironment secrets using dry-run endpoint

Backstage is an open framework for building developer portals. Prior to 3.1.5, authenticated users with permission to execute scaffolder dry-runs can gain access to server-configured environment secrets through the dry-run API response. Secrets are properly redacted in log output but not in all parts of the response payload. Deployments that have configured scaffolder.defaultEnvironment.secrets are affected. This is patched in @backstage/plugin-scaffolder-backend version 3.1.5.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-32237

CVE-2026-32237:

4.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@backstage/plugin-scaffolder-backend	npm	>= 3.1.0, < 3.1.5	3.1.5

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the NunjucksWorkflowRunner.execute method in plugins/scaffolder-backend/src/scaffolder/tasks/NunjucksWorkflowRunner.ts. The patch analysis reveals that prior to the fix, the method did not differentiate between a regular execution and a dry run when handling secrets. Specifically, this.environment?.secrets and task.secrets were passed to the templating context in both scenarios. This allowed sensitive data to be exposed in the response of a dry-run API call. The fix introduces a conditional check (task.isDryRun ? {} : ...) to ensure that secrets are redacted (replaced with an empty object) during a dry run, mitigating the information exposure vulnerability. Therefore, any runtime profile during exploitation would point to the NunjucksWorkflowRunner.execute function as the source of the leak.

Vulnerable functions

NunjucksWorkflowRunner.execute

plugins/scaffolder-backend/src/scaffolder/tasks/NunjucksWorkflowRunner.ts

The 'execute' method within the 'NunjucksWorkflowRunner' class previously passed environment and task secrets to the templating context during a dry run. This allowed an authenticated user with permissions for scaffolder dry-runs to view these secrets in the dry-run API response. The patch ensures that secrets are an empty object if the task is a dry run, thus preventing the leak.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.