# CVE-2026-106459: Backstage Sentry scaffolder improper input validation

Source: https://junglewise.ai/threats/cve-2026-106459-backstage-is-an-open-framework-for-building-developer-portals  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-06. Updated: 2026-10-06  
License: CC BY 4.0 with a link back

CVE-2026-106459 · Severity: high · CVSS 8.5 · Published 2026-10-06

Backstage is an open framework for building developer portals. The Sentry scaffolder module had insufficient validation of API settings, allowing authenticated internal users to direct requests to unintended destinations and potentially expose Sentry integration credentials. An attacker with access to scaffolder actions could exfiltrate credentials or perform unauthorized actions against Sentry or other systems.

Vendors: [Backstage](https://junglewise.ai/threats/vendors/backstage), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-106459 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-106459 being exploited in the wild.

**How severe is CVE-2026-106459?** High severity, with a CVSS score of 8.5, published 6 October 2026.

**Which products and versions are affected?** Backstage @Backstage/Plugin-Scaffolder-Backend-Module-Sentry 0.3.0 to 0.3.8; @backstage/plugin-scaffolder-backend-module-sentry (npm) >= 0.3.0, < 0.3.8, SEMVER:introduced=0.3.0,fixed=0.3.8.

**Is there a fix for CVE-2026-106459?** Yes. @backstage/plugin-scaffolder-backend-module-sentry (npm): upgrade to 0.3.8 or later. Until then: Move any custom action-level apiBaseUrl values to the scaffolder.sentry.apiBaseUrl configuration setting before upgrading to the fixed version. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-106459 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-106459?** Check whether you run Backstage @Backstage/Plugin-Scaffolder-Backend-Module-Sentry or @backstage/plugin-scaffolder-backend-module-sentry (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @backstage/plugin-scaffolder-backend-module-sentry (npm): upgrade to 0.3.8 or later

  ```sh
  npm install @backstage/plugin-scaffolder-backend-module-sentry@0.3.8
  ```


Move any custom action-level apiBaseUrl values to the scaffolder.sentry.apiBaseUrl configuration setting before upgrading to the fixed version.

## Technical details

The @backstage/plugin-scaffolder-backend-module-sentry package failed to properly validate the Sentry API base URL in scaffolder actions, allowing authenticated users to override it to arbitrary destinations. This enables credential disclosure and Server-Side Request Forgery (SSRF) attacks. The fix restricts API requests to the configured API base URL and requires custom apiBaseUrl values to be moved to configuration before upgrading.

## Affected products

- Backstage @backstage/plugin-scaffolder-backend-module-sentry 0.3.0 to 0.3.8

## Identifiers

- CVE-2026-106459
- GHSA-g734-fhp4-7mfp

## Timeline

- 2026-10-06: disclosed
- 2026-09-15: patched

## References

- [https://github.com/backstage/backstage/commit/b0170fad7962fb8c3d71366b5265cf283c7bbcf7](https://github.com/backstage/backstage/commit/b0170fad7962fb8c3d71366b5265cf283c7bbcf7)
- [https://github.com/backstage/backstage/releases/tag/v1.54.8](https://github.com/backstage/backstage/releases/tag/v1.54.8)