Backstage Sentry scaffolder module: Improper input validation enables SSRF and credential disclosure
Summary
The Sentry scaffolder actions in the @backstage/plugin-scaffolder-backend-module-sentry package validate input insufficiently. An authenticated internal user who can run these actions can make the Backstage backend contact unintended destinations and disclose the configured Sentry integration credentials. The impact beyond credential disclosure depends on network reachability and the privileges of the configured token.
Affected
- @backstage/plugin-scaffolder-backend-module-sentry, versions >= 0.3.0 and < 0.3.8
Fixed in
- @backstage/plugin-scaffolder-backend-module-sentry 0.3.8 or later
- Backstage v1.54.8 and v1.55.0 contain the fixed package
Workaround
- Disable the affected Sentry scaffolder actions until the patched package is deployed.
- Restrict the scaffolder.action.execute permission for the affected Sentry actions to trusted users and templates.
- Move any custom action-level apiBaseUrl values to scaffolder.sentry.apiBaseUrl before upgrading, as the fix removes action-level values.
Exploitation
- Not known to be exploited.
- CISA SSVC data lists exploitation as none and automatable as no.
- No public proof of concept found.
Our recommendation
- Upgrade the Sentry scaffolder module to 0.3.8 or later, or upgrade to Backstage v1.54.8 or v1.55.0.
- Before upgrading, move custom apiBaseUrl values to scaffolder.sentry.apiBaseUrl.
- Check whether the module is installed and who can execute the Sentry scaffolder actions.
- If there is a chance untrusted users ran these actions, rotate the Sentry token.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-g734-fhp4-7mfp github.com
- Fix commit b0170fad github.com
- Backstage release v1.54.8 github.com
- Backstage release v1.55.0 github.com
- OSV GHSA-g734-fhp4-7mfp osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 11:18.
Original description (NVD)
Backstage is an open framework for building developer portals. From 0.3.0 until 0.3.8, the @backstage/plugin-scaffolder-backend-module-sentry package is affected by improper input validation in sentry scaffolder actions. An authenticated internal user who can execute the affected actions may cause the backend to contact unintended destinations and disclose Sentry integration credentials. Subsequent impact depends on network reachability and the privileges granted to the configured token. This issue is fixed in version 0.3.8.
NVD references (4)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.