CVE-2026-106459: backstage
Vulnerability summary
CVE-2026-106459 is a high (CVSS 8.5) vulnerability in backstage. EPSS estimates a 0.21% chance of exploitation in the next 30 days, higher than 10.8% of scored vulnerabilities.
Timeline
- 06-10-2026PublishedVulnerability first disclosed.
- 07-10-2026Last modifiedVulnerability information updated.
Description
Backstage is an open framework for building developer portals. From 0.3.0 until 0.3.8, the @backstage/plugin-scaffolder-backend-module-sentry package is affected by improper input validation in sentry scaffolder actions. An authenticated internal user who can execute the affected actions may cause the backend to contact unintended destinations and disclose Sentry integration credentials. Subsequent impact depends on network reachability and the privileges granted to the configured token. This issue is fixed in version 0.3.8.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · NpmEcosystem advisory · calculated8.5HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
- NVDNIST8.5HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
EPSS trend
Probability
0.21%
Chance of exploitation in the next 30 days
Percentile
11%
Versus all other CVEs
30-day change
Change unavailable
Change unavailable
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
- CWE-918Server-Side Request Forgery (SSRF)The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Affected systems
@backstage2 products
- plugin-scaffolder-backend-module-sentry≥ 0.3.0, < 0.3.8
- plugin-scaffolder-backend-module-sentry≥ 0.3.0, < 0.3.8
Linuxfoundation2 products
- backstage≥ 1.47.0, < 1.54.8
- backstage\/plugin-scaffolder-backend-module-sentry≥ 0.3.0, < 0.3.8
Backstage1 product
- backstage≥ 1.47.0, < 1.54.8
3 vendors · 5 products
References
6 links- github.com/backstage/backstage/security/advisories/GHSA-g734-fhp4-7mfpX Refsource CONFIRMWEBMitigationVendor Advisory
- github.com/backstage/backstage/commit/b0170fad7962fb8c3d71366b5265cf283c7bbcf7X Refsource MISCWEBPatch
