CVE-2026-106491

Undergoing Analysis Undergoing Analysis - In Progress

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-07

Assigner: GitHub, Inc.

Description

Backstage is an open framework for building developer portals. Prior to 0.6.17, the @backstage/plugin-proxy-backend package is affected by improper input validation in proxy-backend. An authenticated Backstage user could craft a request URL that causes the proxy-backend to forward the request to a path outside the configured base path on the target server. This is limited to target servers already configured as proxy endpoints and requires Backstage authentication by default. This issue is fixed in version 0.6.17.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-07

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-106491

EUVD

EUVD-2026-94010

Affected Vendors & Products

Vendor	Product	Version / Range
backstage	backstage	< 1.54.6
@backstage	plugin-proxy-backend	< 0.6.17

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

Backstage is an open framework for building developer portals. The @backstage/plugin-proxy-backend package before version 0.6.17 has improper input validation in proxy-backend. An authenticated user can craft a request URL that causes the proxy to forward the request to a path outside the configured base path on the target server. This only affects target servers already set up as proxy endpoints and requires Backstage authentication.

Detection Guidance

To detect this vulnerability, check if your Backstage instance is running a version of @backstage/plugin-proxy-backend prior to 0.6.17. Verify proxy endpoint configurations for improper path handling. Monitor network traffic for requests that deviate from configured base paths.

Impact Analysis

An authenticated attacker could access unintended paths on backend servers configured as proxy endpoints. This may lead to unauthorized data exposure or manipulation of internal services, depending on the server's configuration and exposed endpoints.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized access to proxy endpoints. An authenticated user could craft a request URL to access paths outside the configured base path, which may expose sensitive data or systems. This could lead to data breaches or unauthorized data processing, violating GDPR principles or HIPAA security requirements.

Mitigation Strategies

Upgrade the @backstage/plugin-proxy-backend package to version 0.6.17 or later to address the improper input validation issue.

Hi! I’m here to help you understand CVE-2026-106491. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70