VulnerabilityAnalyzed

CVE-2026-106456

Backstage is an open framework for building developer portals.

MEDIUM 6.5EPSS 0.24%

Does this matter?

Lower severity and a low EPSS score (0.24%). Track it; it rarely justifies an emergency change on its own.

Description

Backstage is an open framework for building developer portals. From 0.5.0 until 0.6.18, the @backstage/plugin-proxy-backend package is affected by inconsistent credential enforcement for overlapping proxy routes. An operator can configure overlapping proxy paths with different credential requirements. When a parent path permits unauthenticated access and a nested path requires credentials, the parent exemption can also cover requests handled by the nested proxy. An unauthenticated caller may therefore reach the nested upstream through Backstage, including with static upstream credentials configured for that proxy. This issue is fixed in version 0.6.18.

CVSS 3.1: 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
EPSS: 0.24% probability · 14th percentile
Public exploits: None in Exploit-DB
CISA KEV: Not listed
Weakness: CWE-863
Affected: linuxfoundation/backstage\/plugin-proxy-backend · linuxfoundation/backstage
Source: security-advisories@github.com

EPSS trend

EPSS moved from 0.2% on 7 October 2026 to 0.2% on 26 October 2026.

References

https://github.com/backstage/backstage/commit/9df92923ac32558bb80edeceafd8de780c44e218Patch
https://github.com/backstage/backstage/releases/tag/v1.55.0Patch, Release Notes
https://github.com/backstage/backstage/security/advisories/GHSA-472h-9c5j-prrrMitigation, Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.