CVE-2026-106491: Backstage Path Traversal Vulnerability

CVE-2026-106491 Overview

CVE-2026-106491 is an improper input validation vulnerability [CWE-20] in the @backstage/plugin-proxy-backend package used by Backstage, an open framework for building developer portals. Versions prior to 0.6.17 allow an authenticated Backstage user to craft a request URL that causes the proxy-backend to forward the request to a path outside the configured base path on the target server. Exploitation is limited to target servers already configured as proxy endpoints and requires Backstage authentication by default. The maintainers resolved the issue in @backstage/plugin-proxy-backend version 0.6.17, shipped with Backstage release v1.54.6.

Critical Impact

An authenticated user can abuse the proxy to reach unintended paths on pre-configured upstream services, breaking the proxy's base-path trust boundary.

Affected Products

• Backstage @backstage/plugin-proxy-backend prior to version 0.6.17
• Backstage releases prior to v1.54.6
• Any Backstage deployment with configured proxy endpoints

Discovery Timeline

• 2026-10-06 - CVE-2026-106491 published to NVD
• 2026-10-07 - Last updated in NVD database

Technical Details for CVE-2026-106491

Vulnerability Analysis

The Backstage proxy-backend plugin forwards HTTP requests from authenticated Backstage users to upstream services declared as proxy endpoints. Each endpoint is bound to a configured base path on the target server. The plugin did not validate that the incoming request path remained within the configured base path after URL decoding. An attacker could include path traversal segments such as .. in the request URL to redirect the forwarded request to a different path on the upstream server.

Because the request still reaches a pre-approved upstream, the attacker inherits any authentication or network trust that Backstage holds for that service. This can expose administrative routes or internal APIs that were never intended to be reachable through the proxy.

Root Cause

The router in plugins/proxy-backend/src/service/router.ts passed the incoming request URL to the proxy middleware without checking for path traversal sequences. The decoded path was not normalized against the configured base path, allowing .. segments to escape the intended route scope.

Attack Vector

Exploitation requires network access to the Backstage instance and valid Backstage authentication by default. An authenticated user submits a crafted request to a configured proxy route containing encoded ../ segments. The proxy then rewrites and forwards the request to an unintended path on the already-trusted upstream server.

     try {
       router.use(
         route,
+        (req, res, next) => {
+          try {
+            const p = decodeURIComponent(req.url.split('?')[0]);
+            if (!p.replace(/\\/g, '/').split('/').includes('..')) {
+              next();
+              return;
+            }
+          } catch {
+            // malformed encoding
+          }
+          res.sendStatus(400);
+        },
         buildMiddleware(
           pathPrefix,
           options.logger,

Source: Backstage patch commit 233287d. The fix decodes the request path, normalizes backslashes, and rejects any request whose path segments contain .. with an HTTP 400 response before the proxy middleware runs.

Detection Methods for CVE-2026-106491

Indicators of Compromise

• Proxy-backend access logs containing .., %2e%2e, or encoded backslash sequences in request URLs targeting /api/proxy/* routes.
• Upstream service logs showing requests from the Backstage service account to paths outside the documented proxy base path.
• HTTP 400 responses from the proxy-backend after upgrading, indicating blocked traversal attempts.

Detection Strategies

• Inspect reverse-proxy and ingress logs for Backstage proxy routes that resolve to upstream paths not declared in the Backstage proxy configuration.
• Correlate authenticated Backstage user sessions with anomalous upstream URI patterns to identify abuse of the proxy trust boundary.
• Review Backstage proxy configuration against observed upstream paths and flag divergence.

Monitoring Recommendations

• Enable verbose request logging on @backstage/plugin-proxy-backend and forward logs to a central SIEM for retention.
• Alert on repeated HTTP 400 responses from the proxy after patching, which indicate active probing.
• Monitor upstream services for unexpected access to administrative or internal endpoints originating from the Backstage service identity.

How to Mitigate CVE-2026-106491

Immediate Actions Required

• Upgrade @backstage/plugin-proxy-backend to version 0.6.17 or later, included in Backstage release v1.54.6.
• Audit the Backstage proxy configuration and remove any endpoints that are not strictly required.
• Review upstream service logs for suspicious access patterns originating from the Backstage proxy prior to the upgrade.

Patch Information

The fix is published in @backstage/plugin-proxy-backend version 0.6.17 and bundled in Backstage Release v1.54.6. Technical details are available in GitHub Security Advisory GHSA-9ghw-48h5-v2w5 and the patch commit.

Workarounds

• Restrict upstream services behind the Backstage proxy with their own authentication and authorization, rather than relying on the proxy base path as a trust boundary.
• Place a reverse proxy or web application firewall in front of upstream services to reject requests containing .. or encoded traversal sequences.
• Limit proxy endpoint definitions to the minimum set required for Backstage functionality.

# Upgrade the vulnerable package in a Backstage workspace
yarn workspace backend add @backstage/plugin-proxy-backend@^0.6.17
yarn install
yarn tsc && yarn build:backend