CVE-2026-106456: Backstage Proxy Backend Auth Bypass Flaw

CVE-2026-106456 Overview

CVE-2026-106456 affects the @backstage/plugin-proxy-backend package used by Backstage, an open framework for building developer portals. Versions from 0.5.0 up to (but not including) 0.6.18 enforce proxy credentials inconsistently across overlapping routes. When an operator configures a parent proxy path that allows unauthenticated access and a nested path that requires credentials, the parent exemption extends to requests that should be handled by the nested proxy. Unauthenticated callers can therefore reach the nested upstream through Backstage, including upstreams protected by static credentials configured in the proxy. The issue is classified as a broken authorization flaw [CWE-863] and is fixed in version 0.6.18.

Critical Impact
Unauthenticated users can reach nested proxy upstreams and consume static upstream credentials that were meant to be gated behind authentication.

Affected Products

Backstage @backstage/plugin-proxy-backend versions 0.5.0 through 0.6.17
Backstage deployments distributing the proxy-backend plugin prior to release v1.55.0
Any Backstage instance configured with overlapping parent/nested proxy routes using mixed credential requirements

Discovery Timeline

2026-10-06 - CVE-2026-106456 published to the National Vulnerability Database
2026-10-07 - Last updated in NVD database

Technical Details for CVE-2026-106456

Vulnerability Analysis

The Backstage proxy backend lets operators define multiple proxy routes that forward requests from the Backstage backend to arbitrary upstreams. Each route can carry its own credential requirement. The plugin resolved credentials based on the parent route match rather than the specific nested route handling the request. A request targeting a nested path that required authentication could satisfy the credential check of the broader, unauthenticated parent route. The upstream call then proceeded using any static credentials attached to the nested proxy configuration.

This effectively collapses two different access policies into the most permissive one. Attackers who understand the configured proxy layout can enumerate nested paths and relay requests to upstream services, including internal APIs, through Backstage.

Root Cause

The root cause is inconsistent authorization enforcement [CWE-863] inside the plugin's request pipeline. The plugin did not pass the httpAuth core service into createRouter, so per-route credential policies were not evaluated against the active request context. The parent route's permissive policy was applied, bypassing the nested route's requirement.

Attack Vector

Exploitation requires a Backstage deployment configured with overlapping proxy routes where the parent permits unauthenticated access and a nested path requires credentials. An unauthenticated remote caller crafts an HTTP request to the nested proxy path. Backstage honors the parent's exemption and forwards the request upstream, attaching any static credentials configured for that proxy.

typescript

// Patch from plugins/proxy-backend/src/plugin.ts
// fix(proxy): apply route credentials consistently
         config: coreServices.rootConfig,
         discovery: coreServices.discovery,
         logger: coreServices.logger,
+        httpAuth: coreServices.httpAuth,
         httpRouter: coreServices.httpRouter,
       },
-      async init({ config, discovery, logger, httpRouter }) {
+      async init({ config, discovery, logger, httpAuth, httpRouter }) {
         await createRouter({
           config,
           discovery,
           logger,
+          httpAuthService: httpAuth,
           httpRouterService: httpRouter,
           additionalEndpoints,
         });

Source: Backstage commit 9df9292. The patch wires the httpAuth core service into the proxy router so credential requirements are evaluated per route.

Detection Methods for CVE-2026-106456

Indicators of Compromise

Successful HTTP responses to nested proxy paths originating from clients that never completed Backstage authentication
Backstage access logs showing requests to proxy routes without associated user identity or session context
Upstream service logs recording calls that carry static proxy credentials but no corresponding Backstage user attribution

Detection Strategies

Review the proxy section of app-config.yaml for overlapping parent and nested routes with different allowedMethods or credential requirements
Replay representative requests against nested proxy paths without authentication and verify that Backstage returns 401 on patched builds
Compare installed @backstage/plugin-proxy-backend versions across environments to identify instances still below 0.6.18

Monitoring Recommendations

Forward Backstage backend access logs to a centralized analytics pipeline and alert on unauthenticated hits to proxy routes
Monitor upstream services for anomalous call volume originating from the Backstage egress IP range
Track plugin version drift in CI/CD pipelines so new deployments do not regress to vulnerable @backstage/plugin-proxy-backend releases

How to Mitigate CVE-2026-106456

Immediate Actions Required

Upgrade @backstage/plugin-proxy-backend to version 0.6.18 or install Backstage release v1.55.0 or later
Audit app-config.yaml for proxy routes that overlap and remove or restructure configurations that mix authenticated and unauthenticated access
Rotate any static upstream credentials that were configured on nested proxy routes while a vulnerable version was deployed

Patch Information

The fix is published in @backstage/plugin-proxy-backend version 0.6.18 and bundled in the Backstage v1.55.0 release. Review the full remediation details in GitHub Security Advisory GHSA-472h-9c5j-prrr and the upstream commit 9df9292.

Workarounds

Remove overlapping proxy route definitions so no nested path inherits a parent's unauthenticated exemption
Set every proxy route that forwards sensitive upstreams to require credentials explicitly until the upgrade can be applied
Place a reverse proxy or ingress policy in front of Backstage that enforces authentication on the affected nested paths

bash

# Verify installed plugin version and upgrade
yarn why @backstage/plugin-proxy-backend
yarn up @backstage/plugin-proxy-backend@^0.6.18
yarn install