Backstage’s proxy module allows overlapping proxy routes to be configured with disparate credential requirements. When a publicly accessible parent route encloses a child route that requires authentication, the authentication rules for the child are overridden and bypassed. An unauthenticated request that matches the parent path can therefore reach the nested upstream service, and if the proxy is configured with static upstream credentials, those credentials can also be transmitted, giving the attacker unintended access to upstream resources.

Backstage and @backstage/plugin‑proxy‑backend versions from 0.5.0 up to (but not including) 0.6.18 are affected; the issue was fixed in 0.6.18.

The vulnerability carries a CVSS score of 4.8, indicating moderate severity. The EPSS score is <1%, indicating a low probability of exploitation, and the issue is not listed in the CISA KEV catalog. The attack requires the ability to configure proxy routes, typically an operator or developer with configuration access. An attacker can exploit this simply by accessing a publicly exposed parent route, bypassing authentication for nested routes, and potentially exfiltrating data or abusing upstream services.