Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
📦
📦 npm
Not in CISA KEV
HIGH severity

Backstage: Improper input validation in Sentry scaffolder actionsGHSA-g734-fhp4-7mfp

HIGHFix: backstage/backstage@b0170fa

GHSA-g734-fhp4-7mfp is a high-severity (CVSS 8.5) Information Exposure vulnerability in @backstage/plugin-scaffolder-backend-module-sentry. A fix is available for @backstage/plugin-scaffolder-backend-module-sentry — see the affected versions and patch details below.

Also known asCVE-2026-106459
Published
Updated
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Oct 18, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

EPSS Exploitation Probability

via FIRST.org ↗
0.2%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs11th percentile — riskier than 11% of all scored CVEsHighest risk

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

GHSA-g734-fhp4-7mfp by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.

Where this sits among everything scored

Of 394,415 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.

Real-World Exposure

1 pkg affected

How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.

0other npm packages depend on this — each one inherits the vulnerability until it's patched upstream
@backstage/plugin-scaffolder-backend-module-sentrynpm
587downloads / week

Description

Impact

An authenticated internal user who can execute the affected actions may cause the backend to contact unintended destinations and disclose Sentry integration credentials. Subsequent impact depends on network reachability and the privileges granted to the configured token.

Patches

Upgrade @backstage/plugin-scaffolder-backend-module-sentry to version 0.3.8 or later. The fixed package is available in Backstage v1.54.8 and Backstage v1.55.0.

The update removes custom action-level apiBaseUrl values. Move any such value to scaffolder.sentry.apiBaseUrl before upgrading.

Workarounds

  • Disable the affected actions until the patched package is deployed.
  • Restrict scaffolder.action.execute permission for the affected Sentry actions to trusted users and templates.

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
📦npm@backstage/plugin-scaffolder-backend-module-sentry≥ 0.3.0&&< 0.3.80.3.8npm install @backstage/plugin-scaffolder-backend-module-sentry@0.3.8

Affected Products

2 products · 2 configurations
Application
backstagelinuxfoundation
≥ 1.47.0 && < 1.54.8
range
Application
backstage\/plugin-scaffolder-backend-module-sentrylinuxfoundation
≥ 0.3.0 && < 0.3.8
range

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for @backstage/plugin-scaffolder-backend-module-sentry, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update @backstage/plugin-scaffolder-backend-module-sentry to 0.3.8 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-g734-fhp4-7mfp is resolved across your whole dependency graph.

  3. Workarounds

    Restrict outbound requests from the affected component to an allowlist of hosts, block access to link-local and internal address ranges at the network layer, and require authentication on internal services so a forged request cannot reach them unauthenticated.

Frequently Asked Questions

### Impact An authenticated internal user who can execute the affected actions may cause the backend to contact unintended destinations and disclose Sentry integration credentials. Subsequent impact depends on network reachability and the privileges granted to the configured token. ### Patches Upgrade `@backstage/plugin-scaffolder-backend-module-sentry` to version `0.3.8` or later. The fixed package is available in [Backstage v1.54.8](https://github.com/backstage/backstage/releases/tag/v1.54.8) and [Backstage v1.55.0](https://github.com/backstage/backstage/releases/tag/v1.55.0). The update
O3 Security · Impact-Aware SCA

Is GHSA-g734-fhp4-7mfp in your dependencies?

Find it across npm, including transitive dependencies.

Scan my dependencies How O3 SCA works
Backstage: Improper input validation in Sentry scaffolder…