What’s Vulnerable › Products

@backstage plugin-scaffolder-backend vulnerabilities

11 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 11 published in the last 12 months.

Check whether your @backstage plugin-scaffolder-backend version is affected

Latest @backstage plugin-scaffolder-backend vulnerabilities

• CVE-2026-106506 — Backstage: Improper input validation in scaffolder task list ordering (CVSS 5.3)
• CVE-2026-106504 — Backstage: Sensitive information exposure in scaffolder task logs (CVSS 6.5)
• CVE-2026-106503 — Backstage: Scaffolder action input authorization bypass (CVSS 8.1)
• CVE-2026-106502 — Backstage: Sensitive information may be exposed in Scaffolder task failure events (CVSS 5.3)
• CVE-2026-106501 — Backstage: Sensitive information exposure in Scaffolder (CVSS 9.6)
• CVE-2026-106500 — Backstage: Improper task state validation in Scaffolder backend (CVSS 8.5)
• CVE-2026-106499 — Backstage: Secret-derived values may be exposed in scaffolder task logs (CVSS 4.9)
• CVE-2026-106462 — Backstage: Scaffolder credential handling may allow unintended GitHub authentication fallback (CVSS 6.4)
• CVE-2026-106461 — Backstage: Incorrect authorization in scaffolder task listing (CVSS 4.3)
• CVE-2026-32237 — @backstage/plugin-scaffolder-backend: Possible exposure of defaultEnvironment secrets using dry-run endpoint (CVSS 6.5)
• CVE-2026-29184 — @backstage/plugin-scaffolder-backend: Potential Session Token Exfiltration via Log Redaction Bypass (CVSS 6.5)