backstage/plugin-scaffolder-backend vulnerabilities
CVEs whose affected-version data names the backstage/plugin-scaffolder-backend package (npm). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
7 CVEsRSS
CVE-2026-106506Medium· 5.3Backstage is an open framework for building developer portals
Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by improper input validation in scaffolder task list ordering. An authenticated Backstage user wi…
CVE-2026-106504Medium· 6.5Backstage is an open framework for building developer portals
Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by sensitive information exposure in scaffolder task logs. An authenticated user who can create a…
CVE-2026-106503High· 8.1Backstage is an open framework for building developer portals
Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by scaffolder action input authorization bypass. An authenticated user wi…
CVE-2026-106502Medium· 5.3Backstage is an open framework for building developer portals
Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package could expose sensitive information in Scaffolder task failure events. Under specific template and failure con…
CVE-2026-106501Critical· 9.6Backstage is an open framework for building developer portals
Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by sensitive information exposure in scaffolder. An authenticated Backsta…
CVE-2026-106500High· 8.5Backstage is an open framework for building developer portals
Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by improper task state validation in scaffolder backend. An authenticated…
CVE-2026-106499Medium· 4.9Backstage is an open framework for building developer portals
Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package could expose secret-derived values in Scaffolder task logs. Deployments that configure sensitive scaffolder.d…