Vulnerability GHSA-8wq8-6859-qx77
Summary
@backstage/plugin-scaffolder-backend: Possible exposure of defaultEnvironment secrets using dry-run endpoint
Details
Impact
Authenticated users with permission to execute scaffolder dry-runs can gain access to server-configured environment secrets through the dry-run API response. Secrets are properly redacted in log output but not in all parts of the response payload.
Deployments that have configured scaffolder.defaultEnvironment.secrets are affected.
Patches
This is patched in @backstage/plugin-scaffolder-backend version 3.1.5
Workarounds
Remove or empty the scaffolder.defaultEnvironment.secrets configuration from app-config.yaml. Alternatively, restrict access to the scaffolder dry-run functionality via the permissions framework.
References
Related Vulnerabilities
Other vulnerabilities affecting the same packages
