CVEvulnerability

CVE-2026-106459

8.5 HIGH Published 2026-10-06 Modified 2026-10-13 Official page ↗
Status
Analyzed
Published
2026-10-06
Last modified
2026-10-13
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Weaknesses
CWE-200, CWE-918

Description

Backstage is an open framework for building developer portals. From 0.3.0 until 0.3.8, the @backstage/plugin-scaffolder-backend-module-sentry package is affected by improper input validation in sentry scaffolder actions. An authenticated internal user who can execute the affected actions may cause the backend to contact unintended destinations and disclose Sentry integration credentials. Subsequent impact depends on network reachability and the privileges granted to the configured token. This issue is fixed in version 0.3.8.

Affected configurations

• linuxfoundation backstage\/plugin-scaffolder-backend-module-sentry (>= 0.3.0 < 0.3.8) • linuxfoundation backstage (>= 1.47.0 < 1.54.8)

Related

Weakness · CWE (2)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-918 Server-Side Request Forgery weakness

References