CVE-2026-106456

Executive Summary

CVE-2026-106456 is an authorization inconsistency in the @backstage/plugin-proxy-backend package of the Backstage developer portal framework, affecting versions from 0.5.0 through 0.6.17. When an operator configures overlapping proxy route paths with differing credential requirements, a parent path configured for unauthenticated access can inadvertently exempt a nested path that was intended to require credentials, allowing unauthenticated callers to reach the nested upstream and consume statically configured upstream credentials. The vulnerability is fixed in version 0.6.18.

Technical Analysis

Backstage is an open framework for building developer portals, and the @backstage/plugin-proxy-backend package is the component that routes requests from the Backstage frontend to configured upstream services. Operators define proxy routes with associated credential requirements, which determine whether a given route may be accessed without authentication or must present credentials.

The defect is an authorization/access-control weakness classified as CWE-863 (Incorrect Authorization). The core issue is inconsistent credential enforcement for overlapping proxy routes. When route paths overlap, the credential policy applied to a parent path and the credential policy applied to a nested child path can conflict. The description states that when a parent path permits unauthenticated access and a nested path requires credentials, the parent exemption can also cover requests handled by the nested proxy.

The practical consequence is an access-control bypass scoped to the proxy layer: an unauthenticated caller may reach the nested upstream through Backstage, including with static upstream credentials configured for that proxy. In other words, the nested proxy's intended authentication boundary is not enforced because the parent path's looser policy is applied to requests that resolve to the nested route.

This is a configuration-dependent flaw. It only manifests when an operator has defined overlapping proxy paths with mismatched credential requirements — specifically a permissive (unauthenticated) parent and a restrictive (credentialed) nested path. The attack surface is the Backstage proxy backend as exposed to the network; the precondition is the overlapping-route configuration.

No function names, class names, URL endpoints, file paths, or parameters beyond the package name and version range are provided in the source data, so the precise code path that merges or evaluates overlapping route policies cannot be described without fabrication. The behavior is best characterized at the vulnerability-class level: a route-matching and policy-resolution inconsistency that applies a less restrictive parent credential policy to a more restrictive nested route.

The CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N (score 4.8) indicates a network-reachable issue requiring no privileges and no user interaction, but with high attack complexity (reflecting the dependency on a specific overlapping-route configuration), limited confidentiality impact, limited integrity impact, and no availability impact, scoped to the vulnerable component. EPSS has not yet scored this CVE; no EPSS value should be assumed. It is not listed in CISA KEV, and no public PoC or exploit code is known.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (incorrect authorization for overlapping proxy routes) and is limited to what the NVD description supports.

1. Reconnaissance / target identification. An attacker identifies a Backstage deployment exposing the proxy backend. The attacker enumerates proxy route paths reachable without authentication. The relevant indicator is the existence of overlapping proxy paths where a permissive parent path and a more restrictive nested path both exist — a configuration an operator may have created intending the nested path to remain credentialed.

2. Triggering the flaw class. The attacker sends a request targeting the nested proxy path through Backstage as an unauthenticated caller. Because the parent path permits unauthenticated access and the nested path requires credentials, the parent exemption is incorrectly applied to the request that resolves to the nested proxy. The credential requirement of the nested route is therefore not enforced against the attacker.

3. Payload / execution method. At the vulnerability-class level, the "payload" is simply an unauthenticated request routed to the nested upstream path. No memory corruption, injection, or code execution is involved; the abuse is a straight authorization bypass. The attacker does not need to supply or steal credentials — the objective is to have Backstage forward the request despite the intended credential gate.

4. Post-exploitation impact. The attacker reaches the nested upstream through Backstage, "including with static upstream credentials configured for that proxy." This means any static credentials Backstage holds for that upstream may be leveraged by the proxied request, potentially granting access to the upstream service that the operator intended to protect behind credentials. Confidentiality and integrity impacts are limited per the CVSS subscores; there is no availability impact.

Impact Assessment

The impact is an authorization bypass at the Backstage proxy layer. Organizations running Backstage with @backstage/plugin-proxy-backend versions 0.5.0 through 0.6.17, and specifically those with overlapping proxy routes where a permissive parent covers a credentialed nested route, are exposed.

CVSS subscores:

• AV:N (Network): exploitable remotely over the network where the Backstage proxy backend is reachable.
• AC:H (High): exploitation depends on a specific overlapping-route configuration, which the attacker generally cannot guarantee and which is operator-defined.
• PR:N (None) / UI:N (None): no privileges or user interaction required on the attacker side — the bypass is precisely what removes the credential requirement.
• S:U (Unchanged): impact is scoped to the vulnerable component.
• C:L / I:L: limited confidentiality and integrity impact, consistent with reaching a nested upstream and potentially using static upstream credentials configured for that proxy.
• A:N: no availability impact.

Blast radius is bounded by which nested upstream services are reachable through the misconfigured overlapping proxy route and the privileges of any static upstream credentials Backstage holds for them. It is not a full-host compromise, but it can defeat an intended authentication boundary to backend services.

Detection Guidance

Sigma Rule

title: Backstage Proxy Backend Authorization Bypass via Overlapping Routes (CVE-2026-106456)
id: 7f3c2a10-9b4e-4d21-8c77-0a6f5e1d2b90
status: experimental
description: Detects unauthenticated requests routed to Backstage proxy-backend nested routes that should require credentials, indicative of CVE-2026-106456 overlapping-route credential bypass.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-106456
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: backstage
detection:
  selection_path:
    cs-uri-stem|contains:
      - '/api/proxy/'
  selection_unauth:
    sc-status:
      - 200
      - 201
      - 202
  filter_authenticated:
    cs-username: '*'
  condition: selection_path and selection_unauth and not filter_authenticated
falsepositives:
  - Intentionally public proxy routes without any nested credentialed path
level: medium
tags:
  - attack.t1190
  - cve.2026.106456

YARA Rule

rule CVE_2026_106456_Backstage_Proxy_Backend_Version
{
    meta:
        description = "Detects @backstage/plugin-proxy-backend package versions affected by CVE-2026-106456 (0.5.0 - 0.6.17)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-106456"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $pkg = "@backstage/plugin-proxy-backend" ascii
        $v050 = "\"version\": \"0.5.0\"" ascii
        $v060 = "\"version\": \"0.6.0\"" ascii
        $v0617 = "\"version\": \"0.6.17\"" ascii

    condition:
        $pkg and ($v050 or $v060 or $v0617)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-106456 Backstage Proxy Backend Unauthenticated Nested Route Access"; flow:established,to_server; http.uri; content:"/api/proxy/"; http.method; content:"GET"; http.header_names; content:"!Authorization"; classtype:attempted-recon; sid:2026106456; rev:1; metadata:cve CVE-2026-106456, vendor Backstage;)

Elastic Detection

sequence by source.ip, url.path with maxspan=30s
  [ http where url.path : "/api/proxy/*" and not http.request.headers.authorization : * ]

Splunk SPL Query

index=web sourcetype=backstage:access
| where match(uri_path, "^/api/proxy/")
| where isnull(authorization_header) OR authorization_header=""
| where http_status IN (200, 201, 202)
| stats count, values(http_status) as statuses, values(dest_host) as upstreams by src_ip, uri_path
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="backstage,web,cve-2026-106456,">
  <rule id="202610456" level="7">
    <if_sid>31100</if_sid>
    <field name="url">/api/proxy/</field>
    <description>CVE-2026-106456: Possible Backstage proxy-backend authorization bypass - unauthenticated request to proxy nested route</description>
    <options>no_full_log</options>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The NVD description states the issue is fixed in version 0.6.18 of @backstage/plugin-proxy-backend.

1. Immediate mitigations

   • Audit Backstage proxy route configuration for overlapping paths where a parent path permits unauthenticated access and a nested path requires credentials. Eliminate the overlap or align credential requirements so a permissive parent does not cover a credentialed nested route.
   • Where such overlaps cannot be removed immediately, enforce authentication at the network/ingress layer (reverse proxy, API gateway, mTLS) so unauthenticated callers cannot reach the affected nested upstream through Backstage.
   • Restrict network reachability of the Backstage proxy backend to trusted clients.
   • Rotate or scope any static upstream credentials configured for affected proxies, since the description notes they may be usable by the bypass.

2. Patch / upgrade steps

   • Upgrade @backstage/plugin-proxy-backend to version 0.6.18 or later.
   • After upgrading, re-verify proxy route configuration to confirm nested credentialed routes remain enforced.

3. Long-term hardening

   • Adopt a configuration model that fails closed: nested routes should inherit or must explicitly re-declare the stricter credential policy, never a looser parent exemption.
   • Add automated validation in CI that flags overlapping proxy routes with mismatched credential requirements.
   • Monitor the upstream Backstage advisory channel for the 0.6.18 release notes and any additional guidance.

References

• NVD — CVE-2026-106456: https://nvd.nist.gov/vuln/detail/CVE-2026-106456
• Backstage project (upstream framework and advisory channel): https://backstage.io/
• @backstage/plugin-proxy-backend package (npm): https://www.npmjs.com/package/@backstage/plugin-proxy-backend
• CWE-863 — Incorrect Authorization: https://cwe.mitre.org/data/definitions/863.html
• CISA KEV catalog (currently does NOT list CVE-2026-106456): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public PoC, exploit code, Nuclei template, or evidence of in-the-wild exploitation or named threat-actor campaigns is available for CVE-2026-106456 at the time of writing.