GitHub Advisoryadvisory · npm

GHSA-9ghw-48h5-v2w5 Backstage: Improper input validation in proxy-backend

MEDIUM Published 2026-10-07 Modified 2026-10-07 Official page ↗
Aliases
CVE-2026-106491
Ecosystem
npm
Packages
@backstage/plugin-proxy-backend
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Weaknesses
CWE-20, CWE-22
Reviewed
2026-10-07

Affected packages

• npm @backstage/plugin-proxy-backend: < 0.6.17 → fixed in 0.6.17

Description

Impact An authenticated Backstage user could craft a request URL that causes the proxy-backend to forward the request to a path outside the configured base path on the target server. This is limited to target servers already configured as proxy endpoints and requires Backstage authentication by default. Patches Patched in `@backstage/plugin-proxy-backend` version `0.6.17` Workarounds • Deploy a reverse proxy or WAF in front of Backstage that normalizes request paths before they reach the backend.

Related

Alias · CVE (1)

  • CVE-2026-106491 Backstage is an open framework for building developer portals. vulnerability

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References