BA
Product
Backstage/plugin-scaffolder-backend
11
CVEs
0
On KEV
9.6
Max CVSS
9
New 30D
Severity mix
Critical 1High 2Medium 8Low 0
Watch
Add Backstage/plugin-scaffolder-backend to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-106501 | 9.6 | Oct 6 | Backstage: Sensitive information exposure in Scaffolder Affected: before 3.3.1; 3.4.0 before 3.4.1; 4.0.0 before 4.0.3; 4.0.4 before 4.1.0 |
| CVE-2026-106500 | 8.5 | Oct 6 | Backstage: Improper task state validation in Scaffolder backend Affected: before 3.3.1; 3.4.0 before 3.4.1; 4.0.0 before 4.0.3; 4.0.4 before 4.1.0 |
| CVE-2026-106503 | 8.1 | Oct 6 | Backstage: Scaffolder action input authorization bypass Affected: before 3.3.1; 3.4.0 before 3.4.1; 4.0.0 before 4.0.3; 4.0.4 before 4.1.0 |
| CVE-2026-106504 | 6.5 | Oct 6 | Backstage: Sensitive information exposure in scaffolder task logs Affected: before 4.1.0 |
| CVE-2026-32237 | 6.5 | Mar 12 | Backstage is an open framework for building developer portals Affected: 3.1.0 before 3.1.5 |
| CVE-2026-29184 | 6.5 | Mar 7 | Backstage is an open framework for building developer portals Affected: before 3.1.4 |
| CVE-2026-106462 | 6.4 | Oct 6 | Backstage: Scaffolder credential handling may allow unintended GitHub authentication fallback Affected: before 0.11.10 |
| CVE-2026-106506 | 5.3 | Oct 6 | Backstage: Improper input validation in scaffolder task list ordering Affected: before 4.1.0 |
| CVE-2026-106502 | 5.3 | Oct 6 | Backstage: Sensitive information may be exposed in Scaffolder task failure events Affected: before 4.1.0 |
| CVE-2026-106499 | 4.9 | Oct 6 | Backstage: Secret-derived values may be exposed in scaffolder task logs Affected: before 4.1.0 |
| CVE-2026-106461 | 4.3 | Oct 6 | Backstage: Incorrect authorization in scaffolder task listing Affected: before 4.1.0 |
Showing 11