Is CVE-2026-106456 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-106456 being exploited in the wild.

How severe is CVE-2026-106456?

Medium severity, with a CVSS score of 4.8, published 6 October 2026.

Which products and versions are affected?

Backstage @Backstage/Plugin-Proxy-Backend 0.5.0 to 0.6.17; @backstage/plugin-proxy-backend (npm) >= 0.5.0, < 0.6.18, SEMVER:introduced=0.5.0,fixed=0.6.18.

Is there a fix for CVE-2026-106456?

Yes. @backstage/plugin-proxy-backend (npm): upgrade to 0.6.18 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-106456 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-106456?

Check whether you run Backstage @Backstage/Plugin-Proxy-Backend or @backstage/plugin-proxy-backend (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-106456: Backstage plugin-proxy-backend auth bypass in overlapping routes

Q: Is there a fix for CVE-2026-106456?

Yes. @backstage/plugin-proxy-backend (npm): upgrade to 0.6.18 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-106456 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-106456?

Check whether you run Backstage @Backstage/Plugin-Proxy-Backend or @backstage/plugin-proxy-backend (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-106456 · Severity: medium · CVSS 4.8 · Published 2026-10-06

Backstage is an open framework for building developer portals. The proxy backend plugin can be misconfigured with overlapping proxy routes that have different authentication requirements. An unauthenticated attacker can bypass credential checks on nested routes if a parent route permits unauthenticated access, potentially reaching upstream services with static credentials configured in Backstage.

Vendors: Backstage, npm.

Quick answers

Is CVE-2026-106456 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-106456 being exploited in the wild.
How severe is CVE-2026-106456?: Medium severity, with a CVSS score of 4.8, published 6 October 2026.
Which products and versions are affected?: Backstage @Backstage/Plugin-Proxy-Backend 0.5.0 to 0.6.17; @backstage/plugin-proxy-backend (npm) >= 0.5.0, < 0.6.18, SEMVER:introduced=0.5.0,fixed=0.6.18.
Is there a fix for CVE-2026-106456?: Yes. @backstage/plugin-proxy-backend (npm): upgrade to 0.6.18 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-106456 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-106456?: Check whether you run Backstage @Backstage/Plugin-Proxy-Backend or @backstage/plugin-proxy-backend (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@backstage/plugin-proxy-backend (npm): upgrade to 0.6.18 or later
```
npm install @backstage/plugin-proxy-backend@0.6.18
```

Technical details

The @backstage/plugin-proxy-backend fails to consistently enforce credential requirements when proxy routes overlap. When a parent path is configured to permit unauthenticated access and a nested child path requires authentication, the parent's exemption incorrectly covers requests to the child path. An attacker with network access to Backstage can craft requests that bypass authentication and reach protected upstream services, including with any static credentials configured for those proxies.

Affected products

Backstage plugin-proxy-backend 0.5.0 to 0.6.17

Identifiers

CVE-2026-106456
GHSA-472h-9c5j-prrr

Timeline

2026-10-06: disclosed
2026-09-15: patched: Fix committed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.