@backstage plugin-scaffolder-backend
10 vulnérabilités publiées citent ce produit.
Tel que les CNA l’écrivent dans leurs fiches CVE (éditeur et produit) ; les versions sont les leurs.
| CVE | Versions vulnérables | Titre | Sévérité | Publiée | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-106506 | < 4.1.0 | Backstage: Improper input validation in scaffolder task list ordering | MEDIUM 5.3 | 0.2 % | ||
| CVE-2026-106504 | < 4.1.0 | Backstage: Sensitive information exposure in scaffolder task logs | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-106503 | < 3.3.1 ; >= 3.4.0, < 3.4.1 ; >= 4.0.0, < 4.0.3 ; … | Backstage: Scaffolder action input authorization bypass | HIGH 8.1 | 0.4 % | ||
| CVE-2026-106502 | < 4.1.0 | Backstage: Sensitive information may be exposed in Scaffolder task failure events | MEDIUM 5.3 | 0.3 % | ||
| CVE-2026-106501 | < 3.3.1 ; >= 3.4.0, < 3.4.1 ; >= 4.0.0, < 4.0.3 ; … | Backstage: Sensitive information exposure in Scaffolder | CRITICAL 9.6 | 0.5 % | ||
| CVE-2026-106500 | < 3.3.1 ; >= 3.4.0, < 3.4.1 ; >= 4.0.0, < 4.0.3 ; … | Backstage: Improper task state validation in Scaffolder backend | HIGH 8.5 | 0.3 % | ||
| CVE-2026-106499 | < 4.1.0 | Backstage: Secret-derived values may be exposed in scaffolder task logs | MEDIUM 4.9 | 0.3 % | ||
| CVE-2026-106462 | < 4.1.0 | Backstage: Scaffolder credential handling may allow unintended GitHub authentication fallback | MEDIUM 6.4 | 0.2 % | ||
| CVE-2026-106461 | < 4.1.0 | Backstage: Incorrect authorization in scaffolder task listing | MEDIUM 4.3 | 0.2 % | ||
| CVE-2026-32237 | < 3.1.5 | @backstage/plugin-scaffolder-backend: Possible exposure of defaultEnvironment secrets using dry-run endpoint | MEDIUM 6.5 | 0.3 % |