CVE-2026-106459

{
  "etk_id": "ETK-2026-810",
  "cve_id": "CVE-2026-106459",
  "display_id": "CVE-2026-106459",
  "ghsa_id": "GHSA-g734-fhp4-7mfp",
  "euvd_id": "EUVD-2026-93993",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Improper input validation in Backstage Sentry scaffolder actions",
  "summary": "@backstage/plugin-scaffolder-backend-module-sentry versions before 0.3.8 mishandle input in Sentry scaffolder actions. An authenticated internal user authorized to run the affected actions could make the backend connect to unintended destinations and potentially expose Sentry integration credentials. Impact depends on network access and the permissions of the configured token.",
  "mitigation": "Upgrade @backstage/plugin-scaffolder-backend-module-sentry to version 0.3.8 or later, and move custom action-level apiBaseUrl settings to scaffolder.sentry.apiBaseUrl before upgrading. Until then, disable affected actions or limit scaffolder.action.execute for them to trusted users and templates.",
  "vendor": "backstage",
  "product": "backstage",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0.3.0, < 0.3.8"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "0.3.8"
      ],
      "package_name": "@backstage/plugin-scaffolder-backend-module-sentry",
      "purl": "pkg:npm/@backstage/plugin-scaffolder-backend-module-sentry"
    }
  ],
  "cwes": [
    200
  ],
  "cvss_score": 8.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
  "epss_score": 0.0021,
  "epss_percentile": 0.1084,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 15.67742,
  "t0_at": "2026-10-06T20:19:37.541000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-06T20:19:37.541000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-06T20:19:37.541000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-106459"
    }
  }
}