Vulnerabilities

TI-2026-69080 CVE-2026-106506 · GHSA-vwp5-f99x-x3rq

Improper input validation in Backstage scaffolder task list ordering

LOW 23

Backstage is an open framework for building developer portals.

CVSS 3.1MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00218 Published 2026-10-06 Partial fix · 1.54.6, 4.1.0 CWE-202

TI-2026-69078 CVE-2026-106504 · GHSA-4xvq-3m68-h444

Sensitive information exposure in Backstage scaffolder task logs

LOW 28

Backstage is an open framework for building developer portals.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00257 Published 2026-10-06 Partial fix · 1.54.6, 4.1.0 CWE-532

TI-2026-69077 CVE-2026-106503 · GHSA-hmp2-4m7g-22cv

Authorization bypass in Backstage Scaffolder action inputs

LOW 38

Backstage is an open framework for building developer portals.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00492 Published 2026-10-06 Partial fix · 1.49.6, 1.50.5 +5 CWE-178

TI-2026-69076 CVE-2026-106502 · GHSA-95p4-vv4g-jxxm

Backstage Scaffolder exposes sensitive data in task failure events

LOW 24

Backstage is an open framework for building developer portals.

CVSS 3.1MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00291 Published 2026-10-06 Partial fix · 1.54.6, 4.1.0 CWE-532

TI-2026-69075 CVE-2026-106501 · GHSA-g2v8-7jhw-pp8p

Sensitive information exposure in Backstage Scaffolder

MEDIUM 43

Backstage is an open framework for building developer portals.

CVSS 3.1CRITICAL 9.6 Network Low privileges No interaction EPSS 0.00484 Published 2026-10-06 Partial fix · 1.49.6, 1.50.5 +5 CWE-200

TI-2026-69074 CVE-2026-106500 · GHSA-xvgh-hmx8-9xxf

Race condition in Backstage scaffolder backend task handling

LOW 39

Backstage is an open framework for building developer portals.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00336 Published 2026-10-06 Partial fix · 1.49.6, 1.50.5 +5 CWE-362

TI-2026-69073 CVE-2026-106499 · GHSA-mfvq-x7vr-rgqg

Secret-derived values exposed in Backstage scaffolder task logs

LOW 22

Backstage is an open framework for building developer portals.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.0027 Published 2026-10-06 Partial fix · 1.54.6, 4.1.0 CWE-532

TI-2026-69058 CVE-2026-106462 · GHSA-29gx-h2m3-xw44

Backstage scaffolder may fall back to broader integration credentials

LOW 28

Backstage is an open framework for building developer portals.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00172 Published 2026-10-06 Partial fix · 1.54.6, 4.1.0 +4 CWE-441

TI-2026-69057 CVE-2026-106461 · GHSA-7hfw-grcm-cqm6

Incorrect authorization in Backstage scaffolder task listing

LOW 19

Backstage is an open framework for building developer portals.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00193 Published 2026-10-06 Partial fix · 1.54.6, 4.1.0 CWE-863

TI-2026-24766 CVE-2026-32237 · GHSA-8wq8-6859-qx77

@backstage/plugin-scaffolder-backend: Possible exposure of defaultEnvironment secrets using dry-run endpoint

LOW 29

Backstage is an open framework for building developer portals.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00284 Published 2026-03-12 Partial fix · 3.1.5 CWE-200

TI-2026-23301 CVE-2026-29184 · GHSA-8qp7-fhr9-fw53

@backstage/plugin-scaffolder-backend: Potential Session Token Exfiltration via Log Redaction Bypass

LOW 29

Backstage is an open framework for building developer portals.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00305 Published 2026-03-07 Partial fix · 3.1.4 CWE-532

Vulnerabilities

Filters