CVE-2026-106491

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-106491", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-10-06T18:46:47.766Z", "datePublished": "2026-10-06T20:45:08.067Z", "dateUpdated": "2026-10-07T17:52:11.914Z"}, "containers": {"cna": {"title": "Backstage: Improper input validation in proxy-backend", "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "lang": "en", "description": "CWE-20: Improper Input Validation", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/backstage/backstage/security/advisories/GHSA-9ghw-48h5-v2w5", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/backstage/backstage/security/advisories/GHSA-9ghw-48h5-v2w5"}, {"name": "https://github.com/backstage/backstage/commit/233287d0ce3133e41549bf92a7470c940a41753c", "tags": ["x_refsource_MISC"], "url": "https://github.com/backstage/backstage/commit/233287d0ce3133e41549bf92a7470c940a41753c"}, {"name": "https://github.com/backstage/backstage/releases/tag/v1.54.6", "tags": ["x_refsource_MISC"], "url": "https://github.com/backstage/backstage/releases/tag/v1.54.6"}], "affected": [{"vendor": "backstage", "product": "backstage", "versions": [{"version": "< 1.54.6", "status": "affected"}]}, {"vendor": "@backstage", "product": "plugin-proxy-backend", "versions": [{"version": "< 0.6.17", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-06T20:45:08.067Z"}, "descriptions": [{"lang": "en", "value": "Backstage is an open framework for building developer portals. Prior to 0.6.17, the @backstage/plugin-proxy-backend package is affected by improper input validation in proxy-backend. An authenticated Backstage user could craft a request URL that causes the proxy-backend to forward the request to a path outside the configured base path on the target server. This is limited to target servers already configured as proxy endpoints and requires Backstage authentication by default. This issue is fixed in version 0.6.17."}], "source": {"advisory": "GHSA-9ghw-48h5-v2w5", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-07T17:51:57.186407Z", "id": "CVE-2026-106491", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-07T17:52:11.914Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-106491", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-10-06T18:46:47.766Z", "datePublished": "2026-10-06T20:45:08.067Z", "dateUpdated": "2026-10-07T17:52:11.914Z"}, "containers": {"cna": {"title": "Backstage: Improper input validation in proxy-backend", "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "lang": "en", "description": "CWE-20: Improper Input Validation", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/backstage/backstage/security/advisories/GHSA-9ghw-48h5-v2w5", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/backstage/backstage/security/advisories/GHSA-9ghw-48h5-v2w5"}, {"name": "https://github.com/backstage/backstage/commit/233287d0ce3133e41549bf92a7470c940a41753c", "tags": ["x_refsource_MISC"], "url": "https://github.com/backstage/backstage/commit/233287d0ce3133e41549bf92a7470c940a41753c"}, {"name": "https://github.com/backstage/backstage/releases/tag/v1.54.6", "tags": ["x_refsource_MISC"], "url": "https://github.com/backstage/backstage/releases/tag/v1.54.6"}], "affected": [{"vendor": "backstage", "product": "backstage", "versions": [{"version": "< 1.54.6", "status": "affected"}]}, {"vendor": "@backstage", "product": "plugin-proxy-backend", "versions": [{"version": "< 0.6.17", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-06T20:45:08.067Z"}, "descriptions": [{"lang": "en", "value": "Backstage is an open framework for building developer portals. Prior to 0.6.17, the @backstage/plugin-proxy-backend package is affected by improper input validation in proxy-backend. An authenticated Backstage user could craft a request URL that causes the proxy-backend to forward the request to a path outside the configured base path on the target server. This is limited to target servers already configured as proxy endpoints and requires Backstage authentication by default. This issue is fixed in version 0.6.17."}], "source": {"advisory": "GHSA-9ghw-48h5-v2w5", "discovery": "UNKNOWN"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-106491", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-07T17:51:57.186407Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-07T17:52:05.602Z"}}]}}

{"affected": [{"affectedData": [{"product": "backstage", "vendor": "backstage", "versions": [{"status": "affected", "version": "< 1.54.6"}]}, {"product": "plugin-proxy-backend", "vendor": "@backstage", "versions": [{"status": "affected", "version": "< 0.6.17"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:linuxfoundation:backstage\\/plugin-proxy-backend:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "C59CBFE3-914A-48D7-B4BF-2BC180F9DA66", "versionEndExcluding": "0.6.17", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*", "matchCriteriaId": "630B6B8B-D515-4FEF-83C7-9CF51C7EB2F5", "versionEndExcluding": "1.54.6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Backstage is an open framework for building developer portals. Prior to 0.6.17, the @backstage/plugin-proxy-backend package is affected by improper input validation in proxy-backend. An authenticated Backstage user could craft a request URL that causes the proxy-backend to forward the request to a path outside the configured base path on the target server. This is limited to target servers already configured as proxy endpoints and requires Backstage authentication by default. This issue is fixed in version 0.6.17."}], "id": "CVE-2026-106491", "lastModified": "2026-10-22T14:10:06.117", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-106491", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-07T17:51:57.186407Z", "version": "2.0.3"}}]}, "published": "2026-10-06T21:17:18.073", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/backstage/backstage/commit/233287d0ce3133e41549bf92a7470c940a41753c"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Release Notes"], "url": "https://github.com/backstage/backstage/releases/tag/v1.54.6"}, {"source": "security-advisories@github.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/backstage/backstage/security/advisories/GHSA-9ghw-48h5-v2w5"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-22"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "plugin-proxy-backend: plugin-proxy-backend: Request forwarding outside configured base path via crafted URL", "id": "2547196", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2547196"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "status": "draft"}, "cwe": "CWE-22", "details": ["Backstage is an open framework for building developer portals. Prior to 0.6.17, the @backstage/plugin-proxy-backend package is affected by improper input validation in proxy-backend. An authenticated Backstage user could craft a request URL that causes the proxy-backend to forward the request to a path outside the configured base path on the target server. This is limited to target servers already configured as proxy endpoints and requires Backstage authentication by default. This issue is fixed in version 0.6.17.", "A flaw was found in the Backstage plugin-proxy-backend component. An authenticated remote attacker can exploit improper input validation by submitting a specially crafted request URL to the proxy backend. This causes the proxy service to forward requests to endpoints outside the configured base path on target servers, potentially leading to unauthorized access to restricted endpoints or sensitive data."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, deploy an upstream reverse proxy or Web Application Firewall (WAF) in front of the Backstage / Red Hat Developer Hub backend configured to normalize incoming URI paths and block path traversal sequences before requests reach the application."}, "name": "CVE-2026-106491", "package_state": [{"cpe": "cpe:/a:redhat:rhdh:1", "fix_state": "Fix deferred", "package_name": "rhdh/rhdh-hub-rhel9", "product_name": "Red Hat Developer Hub"}, {"cpe": "cpe:/a:redhat:ansible_portal:2", "fix_state": "Fix deferred", "package_name": "ansible-automation-platform/automation-portal", "product_name": "Self-service automation portal 2"}, {"cpe": "cpe:/a:redhat:ansible_portal:2", "fix_state": "Fix deferred", "package_name": "ansible-automation-platform/bootc-automation-portal-rhel9", "product_name": "Self-service automation portal 2"}], "public_date": "2026-10-06T20:45:08Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-106491\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-106491\nhttps://github.com/backstage/backstage/commit/233287d0ce3133e41549bf92a7470c940a41753c\nhttps://github.com/backstage/backstage/releases/tag/v1.54.6\nhttps://github.com/backstage/backstage/security/advisories/GHSA-9ghw-48h5-v2w5"], "statement": "Red Hat rates the impact of this vulnerability as Moderate because exploitation requires valid authenticated access to the developer portal and path traversal is confined solely to destinations already configured as proxy endpoints rather than arbitrary internal or external targets. Consequently, an attacker cannot arbitrarily traverse beyond endpoints defined within the proxy service configuration.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.54.6)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "backstage", "source": "cna", "vendor": "backstage"}, "product": "backstage", "vendor": "backstage"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.6.17)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "plugin-proxy-backend", "source": "cna", "vendor": "@backstage"}, "product": "plugin-proxy-backend", "vendor": "backstage"}], "created": "2026-10-07T00:15:07.174971+00:00", "updated": "2026-10-09T08:31:19.882826+00:00", "vendors": ["backstage", "backstage$PRODUCT$backstage", "backstage$PRODUCT$plugin-proxy-backend"]}