GHSA-8wq8-6859-qx77
@backstage/plugin-scaffolder-backend: Possible exposure of defaultEnvironment secrets using dry-run endpoint
Quick fix
GHSA-8wq8-6859-qx77 — @backstage/plugin-scaffolder-backend: upgrade to the fixed version with the command below.
npm install @backstage/plugin-scaffolder-backend@3.1.5Details
### Impact Authenticated users with permission to execute scaffolder dry-runs can gain access to server-configured environment secrets through the dry-run API response. Secrets are properly redacted in log output but not in all parts of the response payload. Deployments that have configured `scaffolder.defaultEnvironment.secrets` are affected. ### Patches
This is patched in `@backstage/plugin-scaffolder-backend` version 3.1.5 ### Workarounds
Remove or empty the `scaffolder.defaultEnvironment.secrets` configuration from `app-config.yaml`. Alternatively, restrict access to the scaffolder dry-run functionality via the permissions framework.
### References
- [Backstage Scaffolder Backend documentation](https://backstage.io/docs/features/software-templates/)
Are you affected?
Enter the version of the package you're using.
Affected packages
3.1.0Fixed in: 3.1.5npm install @backstage/plugin-scaffolder-backend@3.1.5