Backstage/plugin-scaffolder-backend vulnerabilities

3 known vulnerabilities in Backstage/plugin-scaffolder-backend from Linux Foundation. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.1 High severity

  backstage: Improper Handling of Case Sensitivity

  CVE-2026-106503Oct 6, 2026Backstage

  Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by scaffolder action input authorization bypass. An authenticated user with access to affected S

• 9.6 Critical severity

  backstage: Exposure of Sensitive Information to an Unauthorized Actor

  CVE-2026-106501Oct 6, 2026Backstage

  Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by sensitive information exposure in scaffolder. An authenticated Backstage user who can read an

• 8.5 High severity

  backstage: Improper Link Resolution Before File Access

  CVE-2026-106500Oct 6, 2026Backstage

  Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by improper task state validation in scaffolder backend. An authenticated user with permission t