All vulnerabilities
CVE-2026-106491GHSA-9ghw-48h5-v2w5

@backstage/plugin-proxy-backend: Backstage: Improper input validation in proxy-backend

backstage @backstage/plugin-proxy-backendnpmLibraries & packages
Open in ThreatlineRecord JSON
CVSS
6.4Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.27%Chance of exploitation activity in the next 30 days, higher than 18% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in0.6.17Fixed versionGitHub
Published6 Oct 2026Updated 7 Oct 2026CVE List

What fixes it

  • 0.6.17@backstage/plugin-proxy-backend, npmGitHubnpm install @backstage/plugin-proxy-backend@0.6.17

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Impact

An authenticated Backstage user could craft a request URL that causes the proxy-backend to forward the request to a path outside the configured base path on the target server. This is limited to target servers already configured as proxy endpoints and requires Backstage authentication by default.

Patches

Patched in @backstage/plugin-proxy-backend version 0.6.17

Workarounds

  • Deploy a reverse proxy or WAF in front of Backstage that normalizes request paths before they reach the backend.

Text from GitHub Advisory Database

Affected versions 4

  • @backstage/plugin-proxy-backend, npm< 0.6.17GitHub
  • backstageaffected: < 1.54.6CVE List
  • plugin-proxy-backendaffected: < 0.6.17CVE List
  • @backstage/plugin-proxy-backend, npmfrom first release, fixed in 0.6.17OSV

References 5