CVE-2026-106491: @backstage/plugin-proxy-backend Improper Input Validation Vulnerability
Summary
CVE-2026-106491: Backstage: Improper input validation in proxy-backend. Affects @backstage/plugin-proxy-backend versions < 0.6.17. Fixed in 0.6.17. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @backstage/plugin-proxy-backend package is a component of the Backstage platform, which is designed to facilitate the creation of developer portals. This plugin allows users to proxy requests to various backend services, enabling seamless integration and interaction with different APIs. However, due to improper input validation, it is susceptible to vulnerabilities that could allow unauthorized access to sensitive paths on target servers.
Vulnerability Detail
The vulnerability arises from improper input validation in the proxy-backend component, allowing an authenticated Backstage user to craft a request URL that can forward requests to paths outside the configured base path on the target server. This could lead to unauthorized access to sensitive data or services, as it exploits the trust placed in the proxy mechanism. The issue is limited to target servers already configured as proxy endpoints and requires Backstage authentication by default.
How To Fix
Latest published version: 0.6.19 as of 22 Oct 2026
npm install @backstage/plugin-proxy-backend@0.6.19Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.6.17
This is the first release that contains the fix.
npm install @backstage/plugin-proxy-backend@0.6.17Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, deploy a reverse proxy or Web Application Firewall (WAF) in front of Backstage. This setup will normalize request paths before they reach the backend, providing an additional layer of security against this vulnerability.
Conclusion
In summary, CVE-2026-106491 presents a moderate risk due to improper input validation in the @backstage/plugin-proxy-backend package. Users are advised to update to the patched version 0.6.17 or implement workarounds to mitigate potential risks until the update can be applied.
See every vulnerability recorded for @backstage/plugin-proxy-backend →
FAQ
CVE-2026-106491 is a vulnerability in the @backstage/plugin-proxy-backend package that allows authenticated users to exploit improper input validation to access unauthorized paths on target servers.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The CVSS score for this vulnerability is 6.4, indicating a moderate level of risk.
If immediate updates are not possible, consider deploying a reverse proxy or WAF to help mitigate the risk until the package can be updated.
More information can be found in the official advisory on GitHub or by reviewing the package documentation.
References
Related vulnerabilities
Recent vulnerabilities recorded for @backstage/plugin-proxy-backend.
