@backstage Plugin-scaffolder-backend vulnerabilities

• @backstage plugin-scaffolder-backend-module-confluence-to-markdown, backstage, linuxfoundation backstage\/plugin-scaffolder-backend-module-confluence-to-markdown +2 more Backstage: Improper repository path validation in a Scaffolder backend module CVE-2026-106560 Fix available 7.1 HighOctober 7, 2026
• @backstage plugin-scaffolder-backend-module-confluence-to-markdown, backstage, linuxfoundation backstage\/plugin-scaffolder-backend-module-confluence-to-markdown +2 more Backstage: Improper input validation in Confluence to Markdown scaffolder module CVE-2026-106559 Fix available 6.3 MediumOctober 7, 2026
• @backstage plugin-scaffolder-backend, backstage, linuxfoundation backstage\/plugin-scaffolder-backend +2 more Backstage: Improper input validation in scaffolder task list ordering CVE-2026-106506 Fix available 5.3 MediumOctober 6, 2026
• @backstage plugin-scaffolder-backend, backstage, linuxfoundation backstage\/plugin-scaffolder-backend +2 more Backstage: Sensitive information exposure in scaffolder task logs CVE-2026-106504 Fix available 6.5 MediumOctober 6, 2026
• @backstage plugin-scaffolder-backend, backstage, linuxfoundation backstage\/plugin-scaffolder-backend +2 more Backstage: Scaffolder action input authorization bypass CVE-2026-106503 Fix available 8.1 HighOctober 6, 2026
• @backstage plugin-scaffolder-backend, backstage, linuxfoundation backstage\/plugin-scaffolder-backend +2 more Backstage: Sensitive information may be exposed in Scaffolder task failure events CVE-2026-106502 Fix available 5.3 MediumOctober 6, 2026
• @backstage plugin-scaffolder-backend, backstage, linuxfoundation backstage\/plugin-scaffolder-backend +2 more Backstage: Sensitive information exposure in Scaffolder CVE-2026-106501 Fix available 9.6 CriticalOctober 6, 2026
• @backstage plugin-scaffolder-backend, backstage, linuxfoundation backstage\/plugin-scaffolder-backend +2 more Backstage: Improper task state validation in Scaffolder backend CVE-2026-106500 Fix available 8.5 HighOctober 6, 2026
• @backstage plugin-scaffolder-backend, backstage, linuxfoundation backstage\/plugin-scaffolder-backend +2 more Backstage: Secret-derived values may be exposed in scaffolder task logs CVE-2026-106499 Fix available 4.9 MediumOctober 6, 2026
• @backstage plugin-scaffolder-backend-module-bitbucket-cloud, plugin-scaffolder-backend-module-bitbucket-server, backstage +2 more +4 more Backstage: Improper filesystem validation in Bitbucket pull-request scaffolder actions CVE-2026-106486 Fix available 8.5 HighOctober 6, 2026
• backstage, @backstage plugin-scaffolder-backend, plugin-scaffolder-backend-module-azure +10 more +12 more Backstage: Scaffolder credential handling may allow unintended GitHub authentication fallback CVE-2026-106462 Fix available 6.4 MediumOctober 6, 2026
• @backstage plugin-scaffolder-backend, backstage, linuxfoundation backstage\/plugin-scaffolder-backend +2 more Backstage: Incorrect authorization in scaffolder task listing CVE-2026-106461 Fix available 4.3 MediumOctober 6, 2026
• @backstage plugin-scaffolder-backend-module-sentry, backstage, linuxfoundation backstage\/plugin-scaffolder-backend-module-sentry +2 more Backstage: Improper input validation in Sentry scaffolder actions CVE-2026-106459 Fix available 8.5 HighOctober 6, 2026
• @backstage plugin-scaffolder-backend, linuxfoundation backstage\/plugin-scaffolder-backend +1 more @backstage/plugin-scaffolder-backend: Possible exposure of defaultEnvironment secrets using dry-run endpoint CVE-2026-32237 Fix available 4.4 MediumMarch 12, 2026