EUVD-2026-93993

Backstage: Improper input validation in Sentry scaffolder actions...

EUVD-2026-94003

Backstage has iImproper filesystem validation in Bitbucket pull-request scaffolder actions...

EUVD-2026-94059

Backstage: Sensitive information exposure in Scaffolder...

EUVD-2026-94057

Backstage: Secret-derived values may be exposed in scaffolder task logs...

EUVD-2026-94068

Backstage: Scaffolder action input authorization bypass...

EUVD-2026-94058

Backstage: Improper task state validation in Scaffolder backend...

EUVD-2026-93996

Backstage: Incorrect authorization in scaffolder task listing...

EUVD-2026-94060

Backstage may expose sensitive information in Scaffolder task failure events...

Backstage has sensitive information exposure in scaffolder task logs

Impact An authenticated user who can create and read scaffolder tasks may be able to observe sensitive values in task logs in deployments with restrictive action permissions and affected templates. Exploitation requires a denied action whose input contains such a value. Patches Patched in...

EUVD-2026-94069

Backstage has sensitive information exposure in scaffolder task logs...

EUVD-2026-94071

Backstage has improper input validation in scaffolder task list ordering...

Backstage has improper input validation in scaffolder task list ordering

Impact An authenticated Backstage user with permission to create and read relevant scaffolder tasks may be able to infer confidential task data under specific conditions. Successful exploitation requires retained task secrets, visibility of a target task, knowledge of the secret structure, and...

CVE-2026-106559

Backstage is an open framework for building developer portals. Prior to 0.3.25, the @backstage/plugin-scaffolder-backend-module-confluence-to-markdown package is affected by improper input validation in confluence to markdown scaffolder module. Insufficient input validation in the Confluence to...

CVE-2026-106560

Backstage is an open framework for building developer portals. Prior to 0.3.25, the @backstage/plugin-scaffolder-backend-module-confluence-to-markdown package is affected by improper repository path validation in a scaffolder backend module. An authenticated user who can execute an affected...

CVE-2026-106560 Backstage: Improper repository path validation in a Scaffolder backend module

Backstage is an open framework for building developer portals. Prior to 0.3.25, the @backstage/plugin-scaffolder-backend-module-confluence-to-markdown package is affected by improper repository path validation in a scaffolder backend module. An authenticated user who can execute an affected...

EUVD-2026-94373

Backstage is an open framework for building developer portals. Prior to 0.3.25, the @backstage/plugin-scaffolder-backend-module-confluence-to-markdown package is affected by improper repository path validation in a scaffolder backend module. An authenticated user who can execute an affected...

CVE-2026-106560

The Backstage open framework for developer portals contains an improper repository path validation vulnerability in the @backstage/plugin-scaffolder-backend-module-confluence-to-markdown package. Specifically, a scaffolder backend module fails to properly validate repository paths, allowing an au...

CVE-2026-106560 Backstage: Improper repository path validation in a Scaffolder backend module

Backstage is an open framework for building developer portals. Prior to 0.3.25, the @backstage/plugin-scaffolder-backend-module-confluence-to-markdown package is affected by improper repository path validation in a scaffolder backend module. An authenticated user who can execute an affected...

CVE-2026-106559

The Backstage framework is vulnerable in the @backstage/plugin-scaffolder-backend-module-confluence-to-markdown package prior to version 0.3.25 . The root cause is improper input validation within the Confluence to Markdown scaffolder module. This flaw allows an attacker to influence file write o...

CVE-2026-106559 Backstage: Improper input validation in Confluence to Markdown scaffolder module

Backstage is an open framework for building developer portals. Prior to 0.3.25, the @backstage/plugin-scaffolder-backend-module-confluence-to-markdown package is affected by improper input validation in confluence to markdown scaffolder module. Insufficient input validation in the Confluence to...