CVE-2026-106459 · GHSA-g734-fhp4-7mfp

Backstage: Improper input validation in Sentry scaffolder actions

Risk score: 58/100
CVSS: 8.5 v3.1
Exploit chance (30 days): 0.2%
Published: 6 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: Backstage is an open framework for building developer portals. From 0.3.0 until 0.3.8, the @backstage/plugin-scaffolder-backend-module-sentry package is affected by improper input validation in sentry scaffolder actions. An authenticated internal user who can execute the affected actions may cause the backend to conta…
Affected: @backstage/plugin-scaffolder-backend-module-sentry (npm) >= 0.3.0, < 0.3.8
Fix: Upgrade @backstage/plugin-scaffolder-backend-module-sentry to 0.3.8 or later.
Exploitation: No known exploitation

Why it is Yellow

CVSS 8.5 high
On your watchlist: npm

Affected packages

Package	Ecosystem	Vulnerable	Fixed in
@backstage/plugin-scaffolder-backend-module-sentry	npm	>= 0.3.0, < 0.3.8	0.3.8

References

Original description

Backstage is an open framework for building developer portals. From 0.3.0 until 0.3.8, the @backstage/plugin-scaffolder-backend-module-sentry package is affected by improper input validation in sentry scaffolder actions. An authenticated internal user who can execute the affected actions may cause the backend to contact unintended destinations and disclose Sentry integration credentials. Subsequent impact depends on network reachability and the privileges granted to the configured token. This issue is fixed in version 0.3.8.

Last activity 6 Oct 2026. Patch Forecast updates every hour.