CVE-2026-32237

Backstage is an open framework for building developer portals. Prior to 3.1.5, authenticated users with permission to execute scaffolder dry-runs can gain access to server-configured environment secrets through the dry-run API response. Secrets are properly redacted in log output but not in all...

CVE-2026-32237

Backstage vulnerability CVE-2026-32237 affects the @backstage/plugin-scaffolder-backend prior to 3.1.5. Authenticated users with permission to run scaffolder dry-runs can access server-configured environment secrets via the dry-run API response; secrets are redacted in logs but not in all respons...

CVE-2026-32237 @backstage/plugin-scaffolder-backend: Possible exposure of defaultEnvironment secrets using dry-run endpoint

Backstage is an open framework for building developer portals. Prior to 3.1.5, authenticated users with permission to execute scaffolder dry-runs can gain access to server-configured environment secrets through the dry-run API response. Secrets are properly redacted in log output but not in all...

CVE-2026-32237 @backstage/plugin-scaffolder-backend: Possible exposure of defaultEnvironment secrets using dry-run endpoint

Backstage is an open framework for building developer portals. Prior to 3.1.5, authenticated users with permission to execute scaffolder dry-runs can gain access to server-configured environment secrets through the dry-run API response. Secrets are properly redacted in log output but not in all...

CVE-2026-32237 @backstage/plugin-scaffolder-backend: Possible exposure of defaultEnvironment secrets using dry-run endpoint

Backstage is an open framework for building developer portals. Prior to 3.1.5, authenticated users with permission to execute scaffolder dry-runs can gain access to server-configured environment secrets through the dry-run API response. Secrets are properly redacted in log output but not in all...

CVE-2026-32237

Backstage is an open framework for building developer portals. Prior to 3.1.5, authenticated users with permission to execute scaffolder dry-runs can gain access to server-configured environment secrets through the dry-run API response. Secrets are properly redacted in log output but not in all...

Malicious code in @sky-it-livedata-libraries/livedata-commons-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 23622be0c1860486eed767780c0a0de0a46b5b0a736cd99a08ecba95fd57c411 The package @sky-it-livedata-libraries/livedata-commons-client was found to contain malicious code. Source: ghsa-malware...

MAL-2026-1373 Malicious code in @sky-it-livedata-libraries/livedata-commons-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 23622be0c1860486eed767780c0a0de0a46b5b0a736cd99a08ecba95fd57c411 The package @sky-it-livedata-libraries/livedata-commons-client was found to contain malicious code. Source: ghsa-malware...

Malicious code in @sky-it-livedata-libraries/livedata-commons (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 20bdbc3cff45e6eac27e84e332d4efa6ad06a4d593b15610a99115bac25d2931 The package @sky-it-livedata-libraries/livedata-commons was found to contain malicious code. Source: ghsa-malware...

GHSA-8WQ8-6859-QX77 @backstage/plugin-scaffolder-backend: Possible exposure of defaultEnvironment secrets using dry-run endpoint

Impact Authenticated users with permission to execute scaffolder dry-runs can gain access to server-configured environment secrets through the dry-run API response. Secrets are properly redacted in log output but not in all parts of the response payload. Deployments that have configured...

Exposure of Sensitive System Information to an Unauthorized Control Sphere

Overview @backstage/plugin-scaffolder-backend is a The Backstage backend plugin that helps you create new things Affected versions of this package are vulnerable to Exposure of Sensitive System Information to an Unauthorized Control Sphere via the dry-run endpoint when secrets configured in...

EUVD-2026-11675

@backstage/plugin-scaffolder-backend: Possible exposure of defaultEnvironment secrets using dry-run endpoint...

@backstage/plugin-scaffolder-backend: Possible exposure of defaultEnvironment secrets using dry-run endpoint

Impact Authenticated users with permission to execute scaffolder dry-runs can gain access to server-configured environment secrets through the dry-run API response. Secrets are properly redacted in log output but not in all parts of the response payload. Deployments that have configured...

BIT-NGINX-INGRESS-CONTROLLER-2026-3288 ingress-nginx rewrite-target nginx configuration injection

A security issue was discovered in ingress-nginx where the nginx.ingress.kubernetes.io/rewrite-target Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible t...

Malicious code in json-specparse (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 28ad383c55884ea3f12626f13a56f36b7fbc1eab649de47cfcb657478162850c The package json-specparse was found to contain malicious code. Source: ghsa-malware 18627c1c0def6faaa8722de5bc97f27981110eaf8844500039b842de043d2f62...

MAL-2026-1368 Malicious code in json-specparse (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 28ad383c55884ea3f12626f13a56f36b7fbc1eab649de47cfcb657478162850c The package json-specparse was found to contain malicious code. Source: ghsa-malware 18627c1c0def6faaa8722de5bc97f27981110eaf8844500039b842de043d2f62...

Malicious code in mezukabil (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 116aeb117747dfbea2f28ecfaae0e59f69c1c476942bc00335519de4e68a8c84 The package mezukabil was found to contain malicious code. Source: ghsa-malware 554fc63eb509f787fc60a615d7228f13eb692391a1a1dca733d3031716dd2ff8 Any...

MAL-2026-1370 Malicious code in mezukabil (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 116aeb117747dfbea2f28ecfaae0e59f69c1c476942bc00335519de4e68a8c84 The package mezukabil was found to contain malicious code. Source: ghsa-malware 554fc63eb509f787fc60a615d7228f13eb692391a1a1dca733d3031716dd2ff8 Any...

Malicious code in @kinggupong/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3aec3e6bd7152f810947ba89be8ccb87de340b49801eef6c91c2a809330dfb03 The package @kinggupong/baileys was found to contain malicious code. Source: ghsa-malware...

Malicious code in kinggupong (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e715c2381b97a44dc664b3fbb1faf1977b339bc9cc51ad7722b09e24caa2f63 The package kinggupong was found to contain malicious code. Source: ghsa-malware 47fb80c46fcfaba8da9b01d5f99700a8a98a138ce3936b2ed9393db423d5b718 Any...