CVE-2026-32236

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-32236
Backstage is an open framework for building developer portals. Prior to 0.27.1, a Server-Side Request Forgery (SSRF) vulnerability exists in @backstage/plugin-auth-backend when auth.experimentalClientIdMetadataDocuments.enabled is set to true. The CIMD metadata fetch validates the initial client_id hostname against private IP ranges but does not apply the same validation after HTTP redirects. The practical impact is limited. The attacker cannot read the response body from the internal request, cannot control request headers or method, and the feature must be explicitly enabled via an experimental flag that is off by default. Deployments that restrict allowedClientIdPatterns to specific trusted domains are not affected. Patched in @backstage/plugin-auth-backend version 0.27.1.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/backstage/backstage/commit/17038abf2dfdb4abc08a59b1c95af39851de0e07 Patch
https://github.com/backstage/backstage/security/advisories/GHSA-qp4c-xg64-7c6x Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*
History

15 Apr 2026, 21:17

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 0.0 		v2 : unknown
v3 : 7.5

13 Apr 2026, 14:23

Type Values Removed Values Added
References () https://github.com/backstage/backstage/commit/17038abf2dfdb4abc08a59b1c95af39851de0e07 - () https://github.com/backstage/backstage/commit/17038abf2dfdb4abc08a59b1c95af39851de0e07 - Patch
References () https://github.com/backstage/backstage/security/advisories/GHSA-qp4c-xg64-7c6x - () https://github.com/backstage/backstage/security/advisories/GHSA-qp4c-xg64-7c6x - Vendor Advisory
First Time Linuxfoundation
Linuxfoundation backstage
Summary
  • (es) Backstage es un framework abierto para construir portales de desarrollador. Antes de 0.27.1, existe una vulnerabilidad de falsificación de petición del lado del servidor (SSRF) en @backstage/plugin-auth-backend cuando auth.experimentalClientIdMetadataDocuments.enabled está configurado como true. La obtención de metadatos CIMD valida el nombre de host client_id inicial contra rangos de IP privados, pero no aplica la misma validación después de las redirecciones HTTP. El impacto práctico es limitado. El atacante no puede leer el cuerpo de la respuesta de la petición interna, no puede controlar las cabeceras o el método de la petición, y la característica debe habilitarse explícitamente mediante una bandera experimental que está desactivada por defecto. Las implementaciones que restringen allowedClientIdPatterns a dominios de confianza específicos no se ven afectadas. Parcheado en la versión 0.27.1 de @backstage/plugin-auth-backend.
CPE cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*

12 Mar 2026, 19:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-12 19:16

Updated : 2026-04-15 21:17

NVD link : CVE-2026-32236

Mitre link : CVE-2026-32236

CVE.ORG link : CVE-2026-32236

JSON object : View

Products Affected

linuxfoundation

  • backstage
CWE
CWE-918

Server-Side Request Forgery (SSRF)