Is CVE-2026-106491 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-106491 being exploited in the wild.

How severe is CVE-2026-106491?

Medium severity, with a CVSS score of 6.4, published 6 October 2026.

Which products and versions are affected?

Backstage @Backstage/Plugin-Proxy-Backend before 0.6.17; @backstage/plugin-proxy-backend (npm) < 0.6.17, SEMVER:introduced=0,fixed=0.6.17.

Is there a fix for CVE-2026-106491?

Yes. @backstage/plugin-proxy-backend (npm): upgrade to 0.6.17 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-106491 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-106491?

Check whether you run Backstage @Backstage/Plugin-Proxy-Backend or @backstage/plugin-proxy-backend (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-106491: Backstage proxy-backend improper input validation

Q: Is there a fix for CVE-2026-106491?

Yes. @backstage/plugin-proxy-backend (npm): upgrade to 0.6.17 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-106491 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-106491?

Check whether you run Backstage @Backstage/Plugin-Proxy-Backend or @backstage/plugin-proxy-backend (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-106491 · Severity: medium · CVSS 6.4 · Published 2026-10-06

Backstage is an open framework for building internal developer portals. The proxy-backend plugin in versions before 0.6.17 allows authenticated users to bypass path restrictions and access unintended endpoints on configured proxy targets. An attacker could exploit this to access sensitive data or services outside the configured scope.

Vendors: Backstage, npm.

Quick answers

Is CVE-2026-106491 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-106491 being exploited in the wild.
How severe is CVE-2026-106491?: Medium severity, with a CVSS score of 6.4, published 6 October 2026.
Which products and versions are affected?: Backstage @Backstage/Plugin-Proxy-Backend before 0.6.17; @backstage/plugin-proxy-backend (npm) < 0.6.17, SEMVER:introduced=0,fixed=0.6.17.
Is there a fix for CVE-2026-106491?: Yes. @backstage/plugin-proxy-backend (npm): upgrade to 0.6.17 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-106491 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-106491?: Check whether you run Backstage @Backstage/Plugin-Proxy-Backend or @backstage/plugin-proxy-backend (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@backstage/plugin-proxy-backend (npm): upgrade to 0.6.17 or later
```
npm install @backstage/plugin-proxy-backend@0.6.17
```

Technical details

The @backstage/plugin-proxy-backend package fails to properly validate proxy request paths, allowing authenticated users to craft URLs that bypass the configured base path restrictions and access arbitrary paths on target proxy servers. The vulnerability requires Backstage authentication and affects only pre-configured proxy endpoints. The fix validates proxy request paths to prevent unintended routing.

Affected products

Backstage @backstage/plugin-proxy-backend before 0.6.17

Identifiers

CVE-2026-106491
GHSA-9ghw-48h5-v2w5

Timeline

2026-10-06: disclosed
2026-10-06: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.