CVE-2026-66087: Incorrect Authorization

An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to operate task instance in projects they are not authorized to access through the /dolphinscheduler/projects/projectCode/task-instances/taskInstanceId/stop...

CVE-2026-66082: Incorrect Authorization

An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to perform unauthorized operations on workflow schedules, workflow definitions, and task instances in other projects. The affected endpoints check permissions against the supplied projectCode but fail to...

CVE-2026-66084: Incorrect Authorization

An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to modify task definitions in projects they are not authorized to access through the /dolphinscheduler/projects/projectCode/task-definition/code/with-upstream endpoint. The endpoint fails to verify that th...

Exploit for CVE-2026-102782

CVE-2026-102782 — OrdaSoft Simple Membership unauth SQLi Pyth...

GHSA-2CMG-V53W-8XFP Backstage: Improper repository path validation in a Scaffolder backend module

Impact An authenticated user who can execute an affected template and control its repository file location may cause generated content to be written outside the task workspace, within locations writable by the Backstage backend process. Patches Patched in...

GHSA-MFVQ-X7VR-RGQG Backstage: Secret-derived values may be exposed in scaffolder task logs

Impact Deployments that configure sensitive scaffolder.defaultEnvironment.secrets and allow an attacker to create or modify Scaffolder templates are affected. A template author could cause secret-derived values used during template iteration to be persisted in task logs, exposing those values to...

EUVD-2026-94057

Backstage: Secret-derived values may be exposed in scaffolder task logs...

Backstage: Secret-derived values may be exposed in scaffolder task logs

Impact Deployments that configure sensitive scaffolder.defaultEnvironment.secrets and allow an attacker to create or modify Scaffolder templates are affected. A template author could cause secret-derived values used during template iteration to be persisted in task logs, exposing those values to...

EUVD-2026-94058

Backstage: Improper task state validation in Scaffolder backend...

Backstage: Improper task state validation in Scaffolder backend

Impact An authenticated user with permission to create and access Scaffolder tasks may, under specific timing and deployment conditions, affect files accessible to the Backstage backend. If backend application files are writable, the confidentiality, integrity, and availability of the backend may...

GHSA-XVGH-HMX8-9XXF Backstage: Improper task state validation in Scaffolder backend

Impact An authenticated user with permission to create and access Scaffolder tasks may, under specific timing and deployment conditions, affect files accessible to the Backstage backend. If backend application files are writable, the confidentiality, integrity, and availability of the backend may...

CVE-2026-106504

A flaw was found in plugin-scaffolder-backend. An authenticated user with permissions to create and read scaffolder tasks can observe sensitive values in task logs when an execution step is denied by action permissions. This flaw allows an attacker to access sensitive input data, resulting in...

CVE-2026-106461

A flaw was found in plugin-scaffolder-backend. An improper authorization flaw allows an authenticated user to view task metadata outside their intended permissions, resulting in unauthorized information disclosure. This vulnerability occurs during scaffolder task listing when deployment permissio...

GHSA-95P4-VV4G-JXXM Backstage may expose sensitive information in Scaffolder task failure events

Impact Under specific template and failure conditions, an authenticated user may be able to retrieve sensitive values from Scaffolder task events. This can expose backend-managed credentials used during task execution. Patches Patched in @backstage/plugin-scaffolder-backend version 4.1.0...

Backstage may expose sensitive information in Scaffolder task failure events

Impact Under specific template and failure conditions, an authenticated user may be able to retrieve sensitive values from Scaffolder task events. This can expose backend-managed credentials used during task execution. Patches Patched in @backstage/plugin-scaffolder-backend version 4.1.0...

GHSA-4XVQ-3M68-H444 Backstage has sensitive information exposure in scaffolder task logs

Impact An authenticated user who can create and read scaffolder tasks may be able to observe sensitive values in task logs in deployments with restrictive action permissions and affected templates. Exploitation requires a denied action whose input contains such a value. Patches Patched in...

Backstage has sensitive information exposure in scaffolder task logs

Impact An authenticated user who can create and read scaffolder tasks may be able to observe sensitive values in task logs in deployments with restrictive action permissions and affected templates. Exploitation requires a denied action whose input contains such a value. Patches Patched in...

EUVD-2026-94069

Backstage has sensitive information exposure in scaffolder task logs...

GHSA-VWP5-F99X-X3RQ Backstage has improper input validation in scaffolder task list ordering

Impact An authenticated Backstage user with permission to create and read relevant scaffolder tasks may be able to infer confidential task data under specific conditions. Successful exploitation requires retained task secrets, visibility of a target task, knowledge of the secret structure, and...

Backstage has improper input validation in scaffolder task list ordering

Impact An authenticated Backstage user with permission to create and read relevant scaffolder tasks may be able to infer confidential task data under specific conditions. Successful exploitation requires retained task secrets, visibility of a target task, knowledge of the secret structure, and...