What is the CVSS score of CVE-2026-106459?

CVE-2026-106459 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of Backstage Scaffolder are affected by CVE-2026-106459?

Backstage's Sentry scaffolder plugin (versions 0.3.0-0.3.7) contains an input validation flaw that allows authenticated internal users with permission to run Sentry actions to redirect backend…. A patch is available.

How to fix or mitigate CVE-2026-106459?

No vendor-released patch identified at time of analysis. Within 24 hours, restrict access to the Sentry scaffolder actions (@backstage/plugin-scaffolder-backend-module-sentry versions 0.3.0 through 0.3.7) to only essential trusted users, and monitor outbound traffic from the Backstage backend for anomalous destinations. Within 7 days, implement an allowlist for apiBaseUrl to only approved Sentry instances, rotate all Sentry integration tokens, and review Backstage audit logs for unauthorized action executions. Within 30 days, if vendor patched releases become available (as referenced in the advisory), upgrade to the fixed version; otherwise, enforce network egress filtering to block unauthorized outbound requests, and conduct a least-privilege review of Sentry action permissions and token scopes.

Backstage Scaffolder CVE-2026-106459

EUVD-2026-93993 HIGH

Information Exposure (CWE-200)

2026-10-06 GitHub_M

GHSA-g734-fhp4-7mfp

Information Disclosure Backstage Plugin Scaffolder Backend Module Sentry

8.5

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

vuln.today AI

8.5 HIGH

Authenticated scaffolder user gives PR:L; request is network-issued and trivially crafted (AC:L); leaked Sentry token crosses into a separate security authority (S:C, C:H) with limited integrity impact (I:L).

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

POC Analysis Generated

Oct 06, 2026 - 23:22 vuln.today

Patch available

Oct 06, 2026 - 22:20 EUVD

Analysis Generated

Oct 06, 2026 - 21:41 vuln.today

CVE Published

Oct 06, 2026 - 20:19 cve.org

HIGH 8.5

DescriptionCVE.org

Backstage is an open framework for building developer portals. From 0.3.0 until 0.3.8, the @backstage/plugin-scaffolder-backend-module-sentry package is affected by improper input validation in sentry scaffolder actions. An authenticated internal user who can execute the affected actions may cause the backend to contact unintended destinations and disclose Sentry integration credentials. Subsequent impact depends on network reachability and the privileges granted to the configured token. This issue is fixed in version 0.3.8.

AnalysisAI

Improper input validation in the @backstage/plugin-scaffolder-backend-module-sentry scaffolder actions (Backstage 0.3.0 through 0.3.7) lets an authenticated internal Backstage user who is permitted to run the Sentry actions (for example sentry:project:create) supply a caller-controlled apiBaseUrl, causing the Backstage backend to send requests - including the configured Sentry Bearer token - to an attacker-chosen destination. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N, base 8.5) reflects a low-privilege, network-reachable flaw with scope change and high confidentiality impact, since the leaked integration token's usefulness depends on the token's privileges and network reachability. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Requires an authenticated internal Backstage user who holds permission to execute the vulnerable Sentry scaffolder actions (e.g. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N, base 8.5) describes a low-privilege, network-reachable flaw with a scope change - consistent with the description: an authenticated internal Backstage user who can run the Sentry scaffolder actions coerces the backend into sending requests (and the configured Sentry Bearer token) to an unintended destination, a classic SSRF-plus-credential-disclosure pattern confirmed by the commit (which restricts requests to the configured apiBaseUrl and rejects redirects). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Vendor-released patch: upgrade @backstage/plugin-scaffolder-backend-module-sentry to version 0.3.8 (or Backstage release v1.54.8 / v1.55.0 and later), per advisory GHSA-g734-fhp4-7mfp and commit b0170fad7962fb8c3d71366b5265cf283c7bbcf7. … Detailed patch versions, workarounds, and compensating controls in full report.