CVE-2026-106456

Backstage is an open framework for building developer portals. From 0.5.0 until 0.6.18, the @backstage/plugin-proxy-backend package is affected by inconsistent credential enforcement for overlapping proxy routes. An operator can configure overlapping proxy paths with different credential requirements. When a parent path permits unauthenticated access and a nested path requires credentials, the parent exemption can also cover requests handled by the nested proxy. An unauthenticated caller may therefore reach the nested upstream through Backstage, including with static upstream credentials configured for that proxy. This issue is fixed in version 0.6.18.

• CWE-863

• https://github.com/backstage/backstage/commit/9df92923ac32558bb80edeceafd8de780c44e218
• https://github.com/backstage/backstage/releases/tag/v1.55.0
• https://github.com/backstage/backstage/security/advisories/GHSA-472h-9c5j-prrr

Published

Oct 6, 2026

Last Modified

Oct 7, 2026

Status

Awaiting Analysis

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-106450yawkat LZ4 Java provides LZ4 compression for Java. Prior to …5.3
• CVE-2026-106451yawkat LZ4 Java provides LZ4 compression for Java. From 1.7.…7.3
• CVE-2026-106452yawkat LZ4 Java provides LZ4 compression for Java. Prior to …5.3
• CVE-2026-106453yawkat LZ4 Java provides LZ4 compression for Java. Prior to …5.3
• CVE-2026-106454Twisted is an event-based framework for internet application…4.3
• CVE-2026-106455Backstage is an open framework for building developer portal…7.7
• CVE-2026-106457Backstage is an open framework for building developer portal…6.8
• CVE-2026-106458Backstage is an open framework for building developer portal…6.5
• CVE-2026-106459Backstage is an open framework for building developer portal…8.5
• CVE-2026-10646Zephyr's BSD-sockets getaddrinfo() implementation (subsys/ne…7.4
• CVE-2026-106460Backstage is an open framework for building developer portal…6.8
• CVE-2026-106461Backstage is an open framework for building developer portal…4.3