CVE-2026-106459: Improper Input Validation in @backstage/plugin-scaffolder-backend-module-sentry
Summary
CVE-2026-106459: Backstage: Improper input validation in Sentry scaffolder actions. Affects @backstage/plugin-scaffolder-backend-module-sentry versions >= 0.3.0, < 0.3.8. Fixed in 0.3.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @backstage/plugin-scaffolder-backend-module-sentry is a plugin for Backstage, a platform for building developer portals. This plugin integrates Sentry, a tool for error tracking and monitoring, allowing users to scaffold actions that interact with Sentry's API. However, it has been found to have an improper input validation vulnerability that can lead to security risks.
Vulnerability Detail
The vulnerability arises from improper input validation in Sentry scaffolder actions, allowing an authenticated internal user to execute affected actions that may cause the backend to contact unintended destinations. This could lead to the disclosure of Sentry integration credentials, with potential ramifications depending on network reachability and the privileges granted to the configured token. The vulnerability is classified under CWE-200 (Information Exposure) and CWE-918 (Server-Side Request Forgery).
How To Fix
Latest published version: 0.4.1 as of 23 Oct 2026
npm install @backstage/plugin-scaffolder-backend-module-sentry@0.4.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.3.8
This is the first release that contains the fix.
npm install @backstage/plugin-scaffolder-backend-module-sentry@0.3.8Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, disable the affected actions until the patched package is deployed. Additionally, restrict the scaffolder.action.execute permission for the affected Sentry actions to trusted users and templates.
Conclusion
The improper input validation vulnerability in the @backstage/plugin-scaffolder-backend-module-sentry poses significant security risks. It is crucial to upgrade to the patched version to mitigate these risks and ensure the safety of your application.
See every vulnerability recorded for @backstage/plugin-scaffolder-backend-module-sentry →
FAQ
The CVSS score of this vulnerability is 8.5, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The potential impacts include unauthorized access to Sentry integration credentials and possible exploitation depending on the privileges of the configured token.
If an immediate upgrade is not possible, disable the affected actions and restrict permissions to trusted users as a workaround.
More information can be found in the official Backstage GitHub repository and the advisory database.
