Backstage Proxy Backend CVE-2026-106456

Requires the operator to have configured overlapping entries in proxy.endpoints where a parent path grants unauthenticated access (credentials: 'dangerously-allow-unauthenticated') and a nested path under it enforces credentials (credentials: 'require', typically with static upstream credentials via 'headers' or externalAccess static token). The bypass only triggers for nested routes shadowed by such a permissive parent. Limiting factors: this is NOT a default configuration - a deployment with no overlapping public-parent/protected-child proxy routes is not exploitable; High attack complexity (AC:H) reflects this configuration dependency. Affects @backstage/plugin-proxy-backend from 0.5.0 up to (not including) 0.6.18.

This is a genuine but conditional, moderate-severity authorization flaw (CWE-863) rather than a top-priority emergency. The provided CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N, base 4.8 MEDIUM) is internally consistent with the description: network-reachable (proxy over HTTP), no privileges or user interaction for the attacker, but High attack complexity because exploitation depends entirely on the operator having configured overlapping proxy routes with mismatched credential requirements. No EPSS score, KEV entry, or POC was supplied in the intelligence set. Per precision rules this is therefore 'no public exploit identified at time of analysis' - note that absence of EPSS/KEV is not evidence of safety, only missing signal. The dominant risk driver is not attacker skill but configuration prevalence: environments that never create a parent 'dangerously-allow-unauthenticated' route overlapping a nested 'require' route are not exposed at all. Where the vulnerable overlap exists, the impact is real - an unauthenticated caller reaches a protected upstream, potentially using static upstream credentials Backstage injects - but confidentiality/integrity impact is rated Low. Net: patch-worthy and config-auditable, but not a drop-everything issue absent evidence of the risky configuration or active exploitation.

An operator has configured the Backstage proxy with a public parent path (e.g. '/parent-first' set to 'dangerously-allow-unauthenticated') and a nested protected path under it (e.g. '/parent-first/protected' set to 'require', with static upstream credentials). An unauthenticated remote attacker requests the nested protected route; the parent's unauthenticated exemption incorrectly covers it, so Backstage forwards the request to the protected upstream and attaches the configured static credentials. No public exploit was identified at time of analysis; the fix commit's regression test demonstrates the exact request pattern.