Plugin proxy backend: Backstage: Inconsistent credential enforcement for overlapping proxy routes (CVE-2026-106456)

The vulnerability arises from inconsistent credential enforcement in overlapping proxy routes configured in the @backstage/plugin-proxy-backend. When a parent proxy path is configured to allow unauthenticated access (using dangerously-allow-unauthenticated) and a nested proxy path requires credentials, the unauthenticated access allowed by the parent path can extend to the nested path. This allows unauthenticated callers to access the nested upstream service, potentially exposing sensitive data or allowing unauthorized actions depending on the upstream service's capabilities. Exploitation requires a specific overlapping route configuration. The vulnerability is addressed by upgrading to version 0.6.18 or later.

An unauthenticated attacker can access nested upstream services through Backstage if overlapping proxy routes are misconfigured with inconsistent credential requirements. This can lead to unauthorized access impacting confidentiality and integrity of the nested upstream service. The severity is medium with a CVSS 3.1 score of 4.8, reflecting network attack vector, high attack complexity, no privileges or user interaction required, and limited confidentiality and integrity impact.

Upgrade @backstage/plugin-proxy-backend to version 0.6.18 or later, which contains the official fix. Until the patch is applied, avoid nesting credential-protected proxy paths under paths configured with dangerously-allow-unauthenticated. Ensure that overlapping proxy paths have consistent credential requirements. Additionally, restrict direct network access to the Backstage backend to reduce exposure.