https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 02:51:24 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-275911 EUVD-2026-275911 https://cve.radiocsirt.org/vuln/euvd-2026-275911 https://cve.radiocsirt.org/vuln/fkie_cve-2026-32237 <p>Backstage is an open framework for building developer portals. Prior to 3.1.5, authenticated users with permission to execute scaffolder dry-runs can gain access to server-configured environment secrets through the dry-run API response. Secrets are properly redacted in log output but not in all parts of the response payload. Deployments that have configured scaffolder.defaultEnvironment.secrets are affected. This is patched in @backstage/plugin-scaffolder-backend version 3.1.5.</p> <p>Backstage is an open framework for building developer portals. Prior to 3.1.5, authenticated users with permission to execute scaffolder dry-runs can gain access to server-configured environment secrets through the dry-run API response. Secrets are properly redacted in log output but not in all parts of the response payload. Deployments that have configured scaffolder.defaultEnvironment.secrets are affected. This is patched in @backstage/plugin-scaffolder-backend version 3.1.5.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-32237 https://cve.radiocsirt.org/vuln/ghsa-8wq8-6859-qx77 <p><strong>Affected:</strong> npm: @backstage/plugin-scaffolder-backend</p> <p>### Impact Authenticated users with permission to execute scaffolder dry-runs can gain access to server-configured environment secrets through the dry-run API response. Secrets are properly redacted in log output but not in all parts of the response payload. Deployments that have configured `scaffolder.defaultEnvironment.secrets` are affected. ### Patches</p> <p>This is patched in `@backstage/plugin-scaffolder-backend` version 3.1.5 ### Workarounds</p> <p>Remove or empty the `scaffolder.defaultEnvironment.secrets` configuration from `app-config.yaml`. Alternatively, restrict access to the scaffolder dry-run functionality via the permissions framework.</p> <p>### References</p> <p>- [Backstage Scaffolder Backend documentation](https://backstage.io/docs/features/software-templates/)</p> <p><strong>Affected:</strong> npm: @backstage/plugin-scaffolder-backend</p> <p>### Impact Authenticated users with permission to execute scaffolder dry-runs can gain access to server-configured environment secrets through the dry-run API response. Secrets are properly redacted in log output but not in all parts of the response payload. Deployments that have configured `scaffolder.defaultEnvironment.secrets` are affected. ### Patches</p> <p>This is patched in `@backstage/plugin-scaffolder-backend` version 3.1.5 ### Workarounds</p> <p>Remove or empty the `scaffolder.defaultEnvironment.secrets` configuration from `app-config.yaml`. Alternatively, restrict access to the scaffolder dry-run functionality via the permissions framework.</p> <p>### References</p> <p>- [Backstage Scaffolder Backend documentation](https://backstage.io/docs/features/software-templates/)</p> https://cve.radiocsirt.org/vuln/ghsa-8wq8-6859-qx77