fix(deps): update dependency @backstage/plugin-proxy-backend to v0.6.18 [security] by renovate[bot] · Pull Request #5629 · redhat-developer/rhdh

renovate · 2026-10-08T17:31:53Z

This PR contains the following updates:

Package	Change	Age	Confidence
@backstage/plugin-proxy-backend (source)	`0.6.17` → `0.6.18`

Backstage: Inconsistent credential enforcement for overlapping proxy routes

CVE-2026-106456 / GHSA-472h-9c5j-prrr

More information

Details

Impact

An operator can configure overlapping proxy paths with different credential requirements. When a parent path permits unauthenticated access and a nested path requires credentials, the parent exemption can also cover requests handled by the nested proxy. An unauthenticated caller may therefore reach the nested upstream through Backstage, including with static upstream credentials configured for that proxy.

Exploitation requires this specific overlapping route configuration. The resulting confidentiality and integrity impact depends on the capabilities exposed by the nested upstream.

Patches

Upgrade @backstage/plugin-proxy-backend to version 0.6.18 or later. The fixed package is available in Backstage v1.55.0.

Workarounds

Avoid nesting a credential-protected proxy path below a path configured with dangerously-allow-unauthenticated.
Apply the same credential requirement to overlapping proxy paths.
Restrict direct network access to the Backstage backend until the patched package is deployed.

Severity

CVSS Score: 4.8 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

backstage/backstage (@backstage/plugin-proxy-backend)

`v0.6.18`

Compare Source

Patch Changes

736d84e: Use locale-insensitive Unicode casing for consistent string handling across environments.
42580a2: Improved request path handling in the proxy-backend.
9df9292: Ensure HTTP proxy requests consistently apply their configured credential requirements.
Updated dependencies
- @backstage/backend-plugin-api@1.10.1
- @backstage/plugin-proxy-node@0.1.19

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

openshift-ci · 2026-10-08T17:32:06Z

Hi @renovate[bot]. Thanks for your PR.

I'm waiting for a redhat-developer member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

codecov · 2026-10-08T17:34:37Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 75.70%. Comparing base (b9f1aba) to head (0553bc8).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #5629   +/-   ##
=======================================
  Coverage   75.70%   75.70%           
=======================================
  Files          65       65           
  Lines         708      708           
  Branches      100      100           
=======================================
  Hits          536      536           
  Misses        171      171           
  Partials        1        1

Flag	Coverage Δ
rhdh	`75.70% <ø> (ø)`

Components	Coverage Δ
Backend plugins	`100.00% <ø> (ø)`
Backend app	`78.94% <ø> (ø)`
Frontend app	`61.03% <ø> (ø)`

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update b9f1aba...0553bc8. Read the comment docs.

🚀 New features to boost your workflow:

📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

github-actions · 2026-10-08T17:49:01Z

Image was built and published successfully. It is available at:

github-actions · 2026-10-09T16:50:24Z

Image was built and published successfully. It is available at:

github-actions · 2026-10-09T18:20:45Z

Image was built and published successfully. It is available at:

github-actions · 2026-10-12T03:37:55Z

Image was built and published successfully. It is available at:

github-actions · 2026-10-12T07:07:43Z

Image was built and published successfully. It is available at:

github-actions · 2026-10-12T08:19:11Z

Image was built and published successfully. It is available at:

github-actions · 2026-10-12T13:10:07Z

Image was built and published successfully. It is available at:

github-actions · 2026-10-12T14:50:57Z

Image was built and published successfully. It is available at:

github-actions · 2026-10-12T15:42:54Z

Image was built and published successfully. It is available at:

github-actions · 2026-10-13T07:38:54Z

The container image build workflow finished with status: cancelled.

github-actions · 2026-10-13T07:45:08Z

The container image build workflow finished with status: cancelled.

github-actions · 2026-10-14T12:57:17Z

Image was built and published successfully. It is available at:

github-actions · 2026-10-16T14:31:50Z

Image was built and published successfully. It is available at:

github-actions · 2026-10-19T03:25:49Z

Image was built and published successfully. It is available at:

github-actions · 2026-10-19T11:14:23Z

Image was built and published successfully. It is available at:

github-actions · 2026-10-19T13:25:45Z

Image was built and published successfully. It is available at:

github-actions · 2026-10-20T10:17:41Z

Image was built and published successfully. It is available at:

github-actions · 2026-10-22T03:30:17Z

Image was built and published successfully. It is available at:

github-actions · 2026-10-22T14:53:04Z

Image was built and published successfully. It is available at:

github-actions · 2026-10-22T15:52:07Z

The container image build workflow finished with status: cancelled.

github-actions · 2026-10-22T15:58:30Z

The container image build workflow finished with status: cancelled.

github-actions · 2026-10-22T16:15:06Z

Image was built and published successfully. It is available at:

…18 [security] Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

sonarqubecloud · 2026-10-23T14:13:36Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

github-actions · 2026-10-23T14:29:38Z

Image was built and published successfully. It is available at:

renovate Bot added kind/dependency upgrade kind/security labels Oct 8, 2026

renovate Bot requested a review from a team October 8, 2026 17:31

openshift-ci Bot requested review from Zaperex and kim-tsao October 8, 2026 17:32

openshift-ci Bot added the needs-ok-to-test label Oct 8, 2026

renovate Bot force-pushed the renovate/npm-backstage-plugin-proxy-backend-vulnerability branch from 5e6d6e6 to 65f39f8 Compare October 9, 2026 16:31

renovate Bot force-pushed the renovate/npm-backstage-plugin-proxy-backend-vulnerability branch from 65f39f8 to 49c4945 Compare October 9, 2026 18:04

renovate Bot force-pushed the renovate/npm-backstage-plugin-proxy-backend-vulnerability branch from 49c4945 to 75e164e Compare October 12, 2026 03:20

renovate Bot force-pushed the renovate/npm-backstage-plugin-proxy-backend-vulnerability branch from 75e164e to adcba5e Compare October 12, 2026 06:50

renovate Bot force-pushed the renovate/npm-backstage-plugin-proxy-backend-vulnerability branch from adcba5e to 5d2daf4 Compare October 12, 2026 08:01

renovate Bot force-pushed the renovate/npm-backstage-plugin-proxy-backend-vulnerability branch from 5d2daf4 to dfaf5f2 Compare October 12, 2026 12:53

renovate Bot force-pushed the renovate/npm-backstage-plugin-proxy-backend-vulnerability branch from dfaf5f2 to b4503d3 Compare October 12, 2026 14:34

renovate Bot force-pushed the renovate/npm-backstage-plugin-proxy-backend-vulnerability branch from b4503d3 to 102cccd Compare October 12, 2026 15:25

renovate Bot force-pushed the renovate/npm-backstage-plugin-proxy-backend-vulnerability branch 2 times, most recently from d859eda to 9c7e779 Compare October 13, 2026 07:37

renovate Bot force-pushed the renovate/npm-backstage-plugin-proxy-backend-vulnerability branch from 9c7e779 to dfbcf85 Compare October 13, 2026 07:44

renovate Bot force-pushed the renovate/npm-backstage-plugin-proxy-backend-vulnerability branch from de3b587 to 9fb4c4b Compare October 14, 2026 12:40

renovate Bot force-pushed the renovate/npm-backstage-plugin-proxy-backend-vulnerability branch from 9fb4c4b to 3373c3e Compare October 16, 2026 14:14

renovate Bot force-pushed the renovate/npm-backstage-plugin-proxy-backend-vulnerability branch from 3373c3e to 242702c Compare October 19, 2026 03:11

renovate Bot force-pushed the renovate/npm-backstage-plugin-proxy-backend-vulnerability branch from 242702c to f2ebb11 Compare October 19, 2026 10:59

renovate Bot force-pushed the renovate/npm-backstage-plugin-proxy-backend-vulnerability branch from f2ebb11 to ec2f114 Compare October 19, 2026 13:05

renovate Bot force-pushed the renovate/npm-backstage-plugin-proxy-backend-vulnerability branch from ec2f114 to b8b0859 Compare October 20, 2026 10:00

renovate Bot force-pushed the renovate/npm-backstage-plugin-proxy-backend-vulnerability branch from b8b0859 to 3eef940 Compare October 22, 2026 03:12

renovate Bot force-pushed the renovate/npm-backstage-plugin-proxy-backend-vulnerability branch from 3eef940 to cca01ae Compare October 22, 2026 14:34

renovate Bot changed the title ~~fix(deps): update dependency @backstage/plugin-proxy-backend to v0.6.18 [security]~~ fix(deps): update dependency @backstage/plugin-proxy-backend to v0.6.18 [security] - autoclosed Oct 22, 2026

renovate Bot closed this Oct 22, 2026

renovate Bot deleted the renovate/npm-backstage-plugin-proxy-backend-vulnerability branch October 22, 2026 15:04

renovate Bot changed the title ~~fix(deps): update dependency @backstage/plugin-proxy-backend to v0.6.18 [security] - autoclosed~~ fix(deps): update dependency @backstage/plugin-proxy-backend to v0.6.18 [security] Oct 22, 2026

renovate Bot reopened this Oct 22, 2026

renovate Bot force-pushed the renovate/npm-backstage-plugin-proxy-backend-vulnerability branch from cca01ae to 02645e6 Compare October 22, 2026 15:50

renovate Bot force-pushed the renovate/npm-backstage-plugin-proxy-backend-vulnerability branch from 02645e6 to cb87c88 Compare October 22, 2026 15:58

fix(deps): update dependency @backstage/plugin-proxy-backend to v0.6.…

0553bc8

…18 [security] Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

renovate Bot force-pushed the renovate/npm-backstage-plugin-proxy-backend-vulnerability branch from cb87c88 to 0553bc8 Compare October 23, 2026 14:12

Conversation

renovate Bot commented Oct 8, 2026

Backstage: Inconsistent credential enforcement for overlapping proxy routes

Details

Impact

Patches

Workarounds

Severity

References

Release Notes

v0.6.18

Patch Changes

Configuration

Uh oh!

openshift-ci Bot commented Oct 8, 2026

Uh oh!

codecov Bot commented Oct 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

github-actions Bot commented Oct 8, 2026

Uh oh!

github-actions Bot commented Oct 9, 2026

Uh oh!

github-actions Bot commented Oct 9, 2026

Uh oh!

github-actions Bot commented Oct 12, 2026

Uh oh!

github-actions Bot commented Oct 12, 2026

Uh oh!

github-actions Bot commented Oct 12, 2026

Uh oh!

github-actions Bot commented Oct 12, 2026

Uh oh!

github-actions Bot commented Oct 12, 2026

Uh oh!

github-actions Bot commented Oct 12, 2026

Uh oh!

github-actions Bot commented Oct 13, 2026

Uh oh!

github-actions Bot commented Oct 13, 2026

Uh oh!

github-actions Bot commented Oct 14, 2026

Uh oh!

github-actions Bot commented Oct 16, 2026

Uh oh!

github-actions Bot commented Oct 19, 2026

Uh oh!

github-actions Bot commented Oct 19, 2026

Uh oh!

github-actions Bot commented Oct 19, 2026

Uh oh!

github-actions Bot commented Oct 20, 2026

Uh oh!

github-actions Bot commented Oct 22, 2026

Uh oh!

github-actions Bot commented Oct 22, 2026

Uh oh!

github-actions Bot commented Oct 22, 2026

Uh oh!

github-actions Bot commented Oct 22, 2026

Uh oh!

github-actions Bot commented Oct 22, 2026

Uh oh!

sonarqubecloud Bot commented Oct 23, 2026

Quality Gate passed

Uh oh!

github-actions Bot commented Oct 23, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

`v0.6.18`

codecov Bot commented Oct 8, 2026 •

edited

Loading