{"action":"Upgrade @backstage/plugin-proxy-backend to 0.6.18 or later.","affected":[{"fixed":"0.6.18","introduced":"0.5.0"}],"component":"@backstage/plugin-proxy-backend","cve_ids":["CVE-2026-106456"],"ecosystem":"npm","epss":0.00236,"exploited":false,"fixed_versions":["0.6.18"],"ghsa_id":"GHSA-472h-9c5j-prrr","id":"tcs_01M5KEZMFT4V8Z732D0FVBQT5C","modified_at":"2026-10-07T20:30:07.225533458Z","published_at":"2026-10-07T20:25:13Z","references":["https://osv.dev/vulnerability/GHSA-472h-9c5j-prrr","https://github.com/backstage/backstage/security/advisories/GHSA-472h-9c5j-prrr","https://nvd.nist.gov/vuln/detail/CVE-2026-106456","https://github.com/backstage/backstage/commit/9df92923ac32558bb80edeceafd8de780c44e218","https://github.com/backstage/backstage","https://github.com/backstage/backstage/releases/tag/v1.55.0"],"severity":{"label":"medium","score":4.8},"sources":[{"source":"osv","source_id":"GHSA-472h-9c5j-prrr","url":"https://osv.dev/vulnerability/GHSA-472h-9c5j-prrr"}],"summary":"Backstage: Inconsistent credential enforcement for overlapping proxy routes"}