Plugin scaffolder backend module sentry: Backstage: Improper input validation in Sentry scaffolder actions (CVE-2026-106459)

CVE-2026-106459 affects the '@backstage/plugin-scaffolder-backend-module-sentry' package, where improper input validation in Sentry scaffolder actions allows an authenticated internal user with execution permissions to cause the backend to contact unintended destinations, potentially disclosing Sentry integration credentials. The impact depends on network reachability and the privileges of the configured token. The vulnerability is addressed by upgrading to version 0.3.8 or later, which removes custom action-level 'apiBaseUrl' values and requires moving such values to 'scaffolder.sentry.apiBaseUrl'.

An authenticated internal user with permission to execute the affected actions can cause the backend to contact unintended destinations and disclose Sentry integration credentials. The severity is high (CVSS 8.5), with potential confidentiality impact depending on network reachability and token privileges. There is no indication of known exploits in the wild.

Upgrade '@backstage/plugin-scaffolder-backend-module-sentry' to version 0.3.8 or later. The fixed versions are included in Backstage v1.54.8 and v1.55.0. Before upgrading, move any custom action-level 'apiBaseUrl' values to 'scaffolder.sentry.apiBaseUrl'. As a workaround, disable the affected actions until the patch is deployed or restrict 'scaffolder.action.execute' permission for the affected Sentry actions to trusted users and templates.