@backstage plugin-scaffolder-backend vulnerabilities

Newest CVEs

• CVE-2026-106506

  Backstage: Improper input validation in scaffolder task list ordering

  backstage · backstage

  Medium5.3
• CVE-2026-106504

  Backstage: Sensitive information exposure in scaffolder task logs

  backstage · backstage

  Medium6.5
• CVE-2026-106503

  Backstage: Scaffolder action input authorization bypass

  backstage · backstage

  High8.1
• CVE-2026-106502

  Backstage: Sensitive information may be exposed in Scaffolder task failure events

  backstage · backstage

  Medium5.3
• CVE-2026-106501

  Backstage: Sensitive information exposure in Scaffolder

  backstage · backstage

  Critical9.6
• CVE-2026-106500

  Backstage: Improper task state validation in Scaffolder backend

  backstage · backstage

  High8.5
• CVE-2026-106499

  Backstage: Secret-derived values may be exposed in scaffolder task logs

  backstage · backstage

  Medium4.9
• CVE-2026-106462

  Backstage: Scaffolder credential handling may allow unintended GitHub authentication fallback

  backstage · backstage

  Medium6.4
• CVE-2026-106461

  Backstage: Incorrect authorization in scaffolder task listing

  backstage · backstage

  Medium4.3
• CVE-2026-32237

  @backstage/plugin-scaffolder-backend: Possible exposure of defaultEnvironment secrets using dry-run endpoint

  @backstage · plugin-scaffolder-backend

  Medium4.4