PT-2026-107248 · Backstage · @Backstage/Plugin-Scaffolder-Backend-Module-Sentry
CVE-2026-106459
·
Published
2026-10-06
·
Updated
2026-10-07
CVSS v3.1
8.5
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
@backstage/plugin-scaffolder-backend-module-sentry versions 0.3.0 through 0.3.7
Description
Improper input validation in sentry scaffolder actions allows an authenticated internal user to force the backend to contact unintended destinations. This can lead to the disclosure of Sentry integration credentials, with the final impact depending on network reachability and the privileges associated with the configured token.
Recommendations
Update to version 0.3.8.
Exploit
Fix
Information Disclosure
SSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
@Backstage/Plugin-Scaffolder-Backend-Module-Sentry