{"id":"CVE-2026-106459","published":"2026-10-06T21:17:16.450","lastModified":"2026-10-07T17:16:48.390","description":"Backstage is an open framework for building developer portals. From 0.3.0 until 0.3.8, the @backstage/plugin-scaffolder-backend-module-sentry package is affected by improper input validation in sentry scaffolder actions. An authenticated internal user who can execute the affected actions may cause the backend to contact unintended destinations and disclose Sentry integration credentials. Subsequent impact depends on network reachability and the privileges granted to the configured token. This issue is fixed in version 0.3.8.","cvssScore":8.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","cwes":["CWE-200","CWE-918"],"vendors":[],"products":[],"references":[{"url":"https://github.com/backstage/backstage/commit/b0170fad7962fb8c3d71366b5265cf283c7bbcf7","tags":[]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.54.8","tags":[]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.55.0","tags":[]},{"url":"https://github.com/backstage/backstage/security/advisories/GHSA-g734-fhp4-7mfp","tags":[]}],"exploitRefs":[{"url":"https://github.com/backstage/backstage/commit/b0170fad7962fb8c3d71366b5265cf283c7bbcf7","tags":[]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.54.8","tags":[]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.55.0","tags":[]},{"url":"https://github.com/backstage/backstage/security/advisories/GHSA-g734-fhp4-7mfp","tags":[]}],"hasPoc":true,"ai":{"summary":"A vulnerability in Backstage's scaffolder actions allows authenticated users to make the backend contact unintended destinations and leak Sentry integration credentials. This could lead to unauthorized access to Sentry resources and potential credential exposure.","exploitability":"Exploitation requires an authenticated internal user with access to execute affected scaffolder actions, making it moderately difficult but not highly complex to exploit.","blast_radius":"The impact could be significant if the exposed Sentry credentials grant access to sensitive monitoring data or allow manipulation of Sentry configurations across multiple projects.","remediation":"Upgrade to version 0.3.8 or later","detection":"No reliable host or network indicator is derivable from the published description.","tags":["scaffolder","credential-disclosure","backstage"],"model":"garnet-coder","analyzedAt":"2026-10-14T08:54:14.964Z"}}