CVE-2026-106459

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-106459
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-106459.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-106459
Aliases
Published
2026-10-06T20:19:37Z
Modified
2026-10-08T02:50:34Z
Severity
  • 8.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N CVSS Calculator
Summary
Backstage: Improper input validation in Sentry scaffolder actions
Details

Backstage is an open framework for building developer portals. From 0.3.0 until 0.3.8, the @backstage/plugin-scaffolder-backend-module-sentry package is affected by improper input validation in sentry scaffolder actions. An authenticated internal user who can execute the affected actions may cause the backend to contact unintended destinations and disclose Sentry integration credentials. Subsequent impact depends on network reachability and the privileges granted to the configured token. This issue is fixed in version 0.3.8.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-200",
        "CWE-918"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/106xxx/CVE-2026-106459.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "0.3.0"
                },
                {
                    "fixed": "0.3.8"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/backstage/backstage

Affected ranges

Type
GIT
Repo
https://github.com/backstage/backstage
Events
Introduced
e63a312b0c8d3b1e1333caf3eb5f576e9e59ee63
Fixed
b0170fad7962fb8c3d71366b5265cf283c7bbcf7
Fixed
b565780781014c16ad5673facb953fc24ec4d969
Fixed
23161ae67d0f064e97c60c4c62b86e94c43a383e
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "1.47.0"
        },
        {
            "fixed": "1.54.8"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v1.*
v1.47.0
v1.48.0
v1.48.0-next.0
v1.48.0-next.1
v1.48.0-next.2
v1.49.0
v1.49.0-next.0
v1.49.0-next.1
v1.49.0-next.2
v1.50.0
v1.50.0-next.0
v1.50.0-next.1
v1.50.0-next.2
v1.51.0
v1.51.0-next.0
v1.51.0-next.1
v1.51.0-next.2
v1.51.0-next.3
v1.52.0
v1.52.0-next.0
v1.52.0-next.1
v1.52.0-next.2
v1.53.0
v1.53.0-next.0
v1.53.0-next.1
v1.53.0-next.2
v1.54.0
v1.54.0-next.0
v1.54.0-next.1
v1.54.0-next.2
v1.54.0-next.3
v1.54.1
v1.54.2
v1.54.3
v1.54.4
v1.54.5
v1.54.6
v1.54.7
v1.55.0-next.0
v1.55.0-next.1
v1.55.0-next.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-106459.json"