Backstage CVE-2026-106491

Requires an authenticated Backstage session by default (PR:L), and is limited to upstream servers already configured as proxy endpoints in the proxy-backend configuration - a target not configured as a proxy endpoint cannot be reached. The attacker must supply traversal sequences (literal '../' or URL-encoded '%2e%2e') in the request path to a valid proxy route. Limiting factors that reduce realistic risk: authentication is needed unless an endpoint is deliberately set to 'dangerously-allow-unauthenticated', exploitation only redirects within the already-trusted target host, impact is read-oriented path escape rather than full server compromise, and only deployments running @backstage/plugin-proxy-backend before 0.6.17 with configured proxy endpoints are affected.

This is a moderate-severity, authenticated path-traversal/SSRF-style flaw in Backstage's @backstage/plugin-proxy-backend, and the signals point to a real-but-bounded issue rather than an urgent emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, 6.4 Medium) shows network reachability and low attack complexity but requires at least low privileges (PR:L), which aligns with the description's statement that Backstage authentication is required by default. The scope change (S:C) is well-justified because the proxy forwards the manipulated request to a separate target server, so impact crosses a trust boundary. Exploitation status is low: there is no CISA KEV listing, no public exploit referenced, and no EPSS value supplied, so this should be treated as no public exploit identified at time of analysis. The limiting factors are significant - exploitation only works against target servers already configured as proxy endpoints and requires an authenticated session - which narrows real-world impact to information disclosure of unintended paths on already-trusted upstream targets. Net assessment: prioritize patching where proxy endpoints expose sensitive internal services, but this is not a drop-everything, high-real-risk issue given the authentication requirement and absence of exploitation evidence.

An authenticated Backstage user (any account that can reach the proxy routes) crafts a request to a configured proxy endpoint containing traversal sequences such as '../' or URL-encoded '%2e%2e', causing proxy-backend to forward the request to a path outside the endpoint's configured base path on the upstream target server. This lets the user read or interact with unintended resources on an already-trusted internal target. No public proof-of-concept is referenced, though the fixing commit includes regression tests demonstrating the exact traversal payloads.