@backstage plugin-scaffolder-backend vulnerabilities
10 published CVEs name @backstage plugin-scaffolder-backend among the affected products.
- 10Published CVEs10 of them scored
- 10Last 12 monthspublished in the last year
- 1Critical2 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-106506
Backstage: Improper input validation in scaffolder task list ordering
backstage · backstage
Medium5.3 - CVE-2026-106504
Backstage: Sensitive information exposure in scaffolder task logs
backstage · backstage
Medium6.5 - CVE-2026-106503
Backstage: Scaffolder action input authorization bypass
backstage · backstage
High8.1 - CVE-2026-106502
Backstage: Sensitive information may be exposed in Scaffolder task failure events
backstage · backstage
Medium5.3 - CVE-2026-106501
Backstage: Sensitive information exposure in Scaffolder
backstage · backstage
Critical9.6 - CVE-2026-106500
Backstage: Improper task state validation in Scaffolder backend
backstage · backstage
High8.5 - CVE-2026-106499
Backstage: Secret-derived values may be exposed in scaffolder task logs
backstage · backstage
Medium4.9 - CVE-2026-106462
Backstage: Scaffolder credential handling may allow unintended GitHub authentication fallback
backstage · backstage
Medium6.4 - CVE-2026-106461
Backstage: Incorrect authorization in scaffolder task listing
backstage · backstage
Medium4.3 - CVE-2026-32237
@backstage/plugin-scaffolder-backend: Possible exposure of defaultEnvironment secrets using dry-run endpoint
@backstage · plugin-scaffolder-backend
Medium4.4