Skip to contentLinuxfoundation Backstage\/plugin-scaffolder-backend vulnerabilities
- @backstage plugin-scaffolder-backend-module-confluence-to-markdown, backstage, linuxfoundation backstage\/plugin-scaffolder-backend-module-confluence-to-markdown +2 moreBackstage: Improper repository path validation in a Scaffolder backend moduleCVE-2026-106560Fix available7.1 High
- @backstage plugin-scaffolder-backend-module-confluence-to-markdown, backstage, linuxfoundation backstage\/plugin-scaffolder-backend-module-confluence-to-markdown +2 moreBackstage: Improper input validation in Confluence to Markdown scaffolder moduleCVE-2026-106559Fix available6.3 Medium
- @backstage plugin-scaffolder-backend, backstage, linuxfoundation backstage\/plugin-scaffolder-backend +2 moreBackstage: Improper input validation in scaffolder task list orderingCVE-2026-106506Fix available5.3 Medium
- @backstage plugin-scaffolder-backend, backstage, linuxfoundation backstage\/plugin-scaffolder-backend +2 moreBackstage: Sensitive information exposure in scaffolder task logsCVE-2026-106504Fix available6.5 Medium
- @backstage plugin-scaffolder-backend, backstage, linuxfoundation backstage\/plugin-scaffolder-backend +2 moreBackstage: Scaffolder action input authorization bypassCVE-2026-106503Fix available8.1 High
- @backstage plugin-scaffolder-backend, backstage, linuxfoundation backstage\/plugin-scaffolder-backend +2 moreBackstage: Sensitive information may be exposed in Scaffolder task failure eventsCVE-2026-106502Fix available5.3 Medium
- @backstage plugin-scaffolder-backend, backstage, linuxfoundation backstage\/plugin-scaffolder-backend +2 moreBackstage: Sensitive information exposure in ScaffolderCVE-2026-106501Fix available9.6 Critical
- @backstage plugin-scaffolder-backend, backstage, linuxfoundation backstage\/plugin-scaffolder-backend +2 moreBackstage: Improper task state validation in Scaffolder backendCVE-2026-106500Fix available8.5 High
- @backstage plugin-scaffolder-backend, backstage, linuxfoundation backstage\/plugin-scaffolder-backend +2 moreBackstage: Secret-derived values may be exposed in scaffolder task logsCVE-2026-106499Fix available4.9 Medium
- @backstage plugin-scaffolder-backend-module-bitbucket-cloud, plugin-scaffolder-backend-module-bitbucket-server, backstage +2 more +4 moreBackstage: Improper filesystem validation in Bitbucket pull-request scaffolder actionsCVE-2026-106486Fix available8.5 High
- backstage, @backstage plugin-scaffolder-backend, plugin-scaffolder-backend-module-azure +10 more +12 moreBackstage: Scaffolder credential handling may allow unintended GitHub authentication fallbackCVE-2026-106462Fix available6.4 Medium
- @backstage plugin-scaffolder-backend, backstage, linuxfoundation backstage\/plugin-scaffolder-backend +2 moreBackstage: Incorrect authorization in scaffolder task listingCVE-2026-106461Fix available4.3 Medium
- @backstage plugin-scaffolder-backend-module-sentry, backstage, linuxfoundation backstage\/plugin-scaffolder-backend-module-sentry +2 moreBackstage: Improper input validation in Sentry scaffolder actionsCVE-2026-106459Fix available8.5 High
- @backstage plugin-scaffolder-backend, linuxfoundation backstage\/plugin-scaffolder-backend +1 more@backstage/plugin-scaffolder-backend: Possible exposure of defaultEnvironment secrets using dry-run endpointCVE-2026-32237Fix available4.4 Medium
- backstage, linuxfoundation backstage\/plugin-scaffolder-backend +1 more@backstage/plugin-scaffolder-backend: Potential Session Token Exfiltration via Log Redaction BypassCVE-2026-29184Fix available2.0 Low