CVE-2026-106456
Backstage: Inconsistent credential enforcement for overlapping proxy routes
Backstage is an open framework for building developer portals. From 0.5.0 until 0.6.18, the @backstage/plugin-proxy-backend package is affected by inconsistent credential enforcement for overlapping proxy routes. An operator can configure overlapping proxy paths with different credential requirements. When a parent path permits unauthenticated access and a nested path requires credentials, the parent exemption can also cover requests handled by the nested proxy. An unauthenticated caller may therefore reach the nested upstream through Backstage, including with static upstream credentials configured for that proxy. This issue is fixed in version 0.6.18.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Backstage: Inconsistent credential enforcement for overlapping proxy routes
Backstage is an open framework for building developer portals. From 0.5.0 until 0.6.18, the @backstage/plugin-proxy-backend package is affected by inconsistent credential enforcement for overlapping proxy routes. An operator can configure overlapping proxy paths with different credential requirements. When a parent path permits unauthenticated access and a nested path requires credentials, the parent exemption can also cover requests handled by the nested proxy. An unauthenticated caller may therefore reach the nested upstream through Backstage, including with static upstream credentials configured for that proxy. This issue is fixed in version 0.6.18.
- Record
CVE-2026-106456- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-863
- Updated
- 2026-11-02
EUVDEUVD-2026-93989
Backstage is an open framework for building developer portals. From 0.5.0 until 0.6.18, the @backstage/plugin-proxy-backend package is affected by inconsistent credential enforcement for overlapping proxy routes. An operator can configure overlapping proxy paths with different credential requirements. When a parent path permits unauthenticated access and a nested path requires credentials, the parent exemption can also cover requests handled by the nested proxy. An unauthenticated caller may therefore reach the nested upstream through Backstage, including with static upstream credentials configured for that proxy. This issue is fixed in version 0.6.18.
- Record
EUVD-2026-93989- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-472h-9c5j-prrr
Backstage: Inconsistent credential enforcement for overlapping proxy routes
Impact
An operator can configure overlapping proxy paths with different credential requirements. When a parent path permits unauthenticated access and a nested path requires credentials, the parent exemption can also cover requests handled by the nested proxy. An unauthenticated caller may therefore reach the nested upstream through Backstage, including with static upstream credentials configured for that proxy.
Exploitation requires this specific overlapping route configuration. The resulting confidentiality and integrity impact depends on the capabilities exposed by the nested upstream.
Patches
Upgrade @backstage/plugin-proxy-backend to version 0.6.18 or later. The fixed package is available in Backstage v1.55.0.
Workarounds
- Avoid nesting a credential-protected proxy path below a path configured with
dangerously-allow-unauthenticated. - Apply the same credential requirement to overlapping proxy paths.
- Restrict direct network access to the Backstage backend until the patched package is deployed.
- Record
GHSA-472h-9c5j-prrr- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-863
- Updated
- 2026-11-02
NVD
Backstage is an open framework for building developer portals. From 0.5.0 until 0.6.18, the @backstage/plugin-proxy-backend package is affected by inconsistent credential enforcement for overlapping proxy routes. An operator can configure overlapping proxy paths with different credential requirements. When a parent path permits unauthenticated access and a nested path requires credentials, the parent exemption can also cover requests handled by the nested proxy. An unauthenticated caller may therefore reach the nested upstream through Backstage, including with static upstream credentials configured for that proxy. This issue is fixed in version 0.6.18.
- Record
CVE-2026-106456- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-863
- Updated
- 2026-11-02
OSV
Backstage: Inconsistent credential enforcement for overlapping proxy routes
Backstage is an open framework for building developer portals. From 0.5.0 until 0.6.18, the @backstage/plugin-proxy-backend package is affected by inconsistent credential enforcement for overlapping proxy routes. An operator can configure overlapping proxy paths with different credential requirements. When a parent path permits unauthenticated access and a nested path requires credentials, the parent exemption can also cover requests handled by the nested proxy. An unauthenticated caller may therefore reach the nested upstream through Backstage, including with static upstream credentials configured for that proxy. This issue is fixed in version 0.6.18.
- Record
CVE-2026-106456- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-863
- Updated
- 2026-11-02
OSVGHSA-472h-9c5j-prrr
Backstage: Inconsistent credential enforcement for overlapping proxy routes
Impact
An operator can configure overlapping proxy paths with different credential requirements. When a parent path permits unauthenticated access and a nested path requires credentials, the parent exemption can also cover requests handled by the nested proxy. An unauthenticated caller may therefore reach the nested upstream through Backstage, including with static upstream credentials configured for that proxy.
Exploitation requires this specific overlapping route configuration. The resulting confidentiality and integrity impact depends on the capabilities exposed by the nested upstream.
Patches
Upgrade @backstage/plugin-proxy-backend to version 0.6.18 or later. The fixed package is available in Backstage v1.55.0.
Workarounds
- Avoid nesting a credential-protected proxy path below a path configured with
dangerously-allow-unauthenticated. - Apply the same credential requirement to overlapping proxy paths.
- Restrict direct network access to the Backstage backend until the patched package is deployed.
- Record
GHSA-472h-9c5j-prrr- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-863
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
@backstage/plugin-proxy-backendnpm |
0.5.0 up to 0.6.18 | 0.6.18 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-106456 is a medium vulnerability (CVSS 4.8) in @backstage Plugin-proxy-backend, published October 6, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.24%, the 15th percentile. Fixed in @backstage/plugin-proxy-backend 0.6.18.
References
github.com/backstage/backstage/security/advisories/GHSA-472h-9c5j-prrr
nvd.nist.gov/vuln/detail/CVE-2026-106456