@backstage/plugin-proxy-backend@0.6.18-next.0

@backstage/plugin-proxy-backend is an A Backstage backend plugin that helps you set up proxy endpoints in the backend

Affected versions of this package are vulnerable to Incorrect Authorization via inconsistent application of route credentials in the proxy router (plugins/proxy-backend/src/service/router.ts). The buildMiddleware function registers the dangerously-allow-unauthenticated auth policy on the HTTP router only when that specific route is configured with that policy, but the policy registration is decoupled from the per-request credential enforcement. As a result, a credential-protected proxy route nested below a path already registered as dangerously-allow-unauthenticated inherits the unauthenticated policy, allowing an unauthenticated attacker to reach the protected route without supplying valid credentials. The fix introduces a dedicated readCredentialsPolicy helper and moves auth-policy registration out of buildMiddleware so that each route's credentials setting is applied consistently at the router level.

Upgrade @backstage/plugin-proxy-backend to version 0.6.18 or higher.