Unexpected visibility of environment variable configurations in @backstage/plugin-app-backend
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
Backstage is an open framework for building developer portals. Configuration supplied through APP_CONFIG_* environment variables, for example APP_CONFIG_backend_listen_port=7007, where unexpectedly ignoring the visibility defined in configuration schema. This occurred even if the configuration schema specified that they should have backend or secret visibility. This was an intended feature of the APP_CONFIG_* way of supplying configuration, but now clearly goes against the expected behavior of the configuration system. This behavior leads to a risk of potentially exposing sensitive configuration details intended to remain private or restricted to backend processes. The issue has been resolved in version 0.3.75 of the @backstage/plugin-app-backend package. As a temporary measure, avoid supplying secrets using the APP_CONFIG_ configuration pattern. Consider alternative methods for setting secrets, such as the environment substitution available for Backstage configuration.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| backstage | backstage | before 0.3.75 | 0.3.75 | Patch available | CNA |
| — | @backstage/plugin-app-backend (npm) | before 0.3.75 | 0.3.75 | Patch available | GHSA-qc4v-xq2m-65wc |
- backstage Vendorbackstage Affected before 0.3.75 Fixed in 0.3.75 Patch available CNA
- @backstage/plugin-app-backend (npm) Vendor— Affected before 0.3.75 Fixed in 0.3.75 Patch available GHSA-qc4v-xq2m-65wc
CPE names CISA-ADP · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:backstage:backstage:*:*:*:*:*:*:*:* | — | — | — |
- cpe:2.3:a:backstage:backstage:*:*:*:*:*:*:*:* Versions — — ·—
Remediation
- Fix · CNA backstage (backstage) Fixed in 0.3.75
- Fix · GHSA-qc4v-xq2m-65wc @backstage/plugin-app-backend (npm) Fixed in 0.3.75 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Developer Hub (RHDH) 1.4 | Fixed | — |
Not affected: 2 products
- Red Hat Developer Hub (RHDH) 1.4
- Red Hat Developer Hub 1
Timeline
- 2026-10-02 Threatist record created from CVE-2024-47762
- 2026-10-03 Alias added: GHSA-qc4v-xq2m-65wc
- 2026-10-27 Affected versions changed · Red Hat
References
More backstage vulnerabilities
- TI-2026-33119 Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys KEVCVSS 3.1CRITICAL 9.6
- TI-2018-10499 Integer overflow in backstage kernel KEVCVSS 3.0HIGH 7.8
- TI-2024-08998 Remote Code Execution in kedro-org/kedro CVSS 3.0CRITICAL 9.8
- TI-2023-12294 Dragonfly2 vulnerable to hard coded cyptographic key CVSS 3.1CRITICAL 9.8
- TI-2021-12074 Authentication vulnerability in MOSN v.0.23.0 allows attacker to escalate privileges via… CVSS 3.1CRITICAL 9.8
- TI-2019-04061 runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows… CVSS 3.1HIGH 8.6
Sources
- CVE-2024-47762 · CVE Program
- CVE-2024-47762 · NVD
- FIRST EPSS
- GHSA-qc4v-xq2m-65wc · GitHub Advisory Database · CC BY 4.0
- CVE-2024-47762 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences