Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
Versions of the npm package @backstage/plugin-proxy-backend before 0.6.17 are affected by improper input validation. An authenticated Backstage user could craft a request URL that makes the proxy forward the request to a path outside the configured base path on a target server that is already configured as a proxy endpoint. Upgrade to @backstage/plugin-proxy-backend version 0.6.17 or later; the source also suggests, as a workaround, placing a reverse proxy or WAF in front of Backstage that normalizes request paths.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 6.4 | Medium | 3.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N | CNA (GitHub_M) |
- CISA KEV Not listed.
- EPSS 0.0027, the 19th percentile, on 9 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.
Timeline
- 31 Oct 2026, 13:33 UTC First seen by agentprime
- 31 Oct 2026, 13:33 UTC Confirmed by OSV
Sources
- GitHub Advisory Database: GHSA-9ghw-48h5-v2w5
- OSV: GHSA-9ghw-48h5-v2w5
- github.com/backstage/backstage/security/advisories/GHSA-9ghw-48h5-v2w5
- nvd.nist.gov/vuln/detail/CVE-2026-106491
- github.com/backstage/backstage/commit/233287d0ce3133e41549bf92a7470c940a41753c
- github.com/backstage/backstage
- github.com/backstage/backstage/releases/tag/v1.54.6