← Vulnerability feed

Vulnerability record · CVE-2026-32236 · published 12 March 2026

CVE-2026-32236: Linuxfoundation backstage server-side request forgery (ssrf) vulnerability

Linuxfoundation · Backstage

Backstage is an open framework for building developer portals. Prior to 0.27.1, a Server-Side Request Forgery (SSRF) vulnerability exists in @backstage/plugin-auth-backend when auth.experimentalClientIdMetadataDocuments.enabled is set to true. The CIMD metadata fetch validates the initial client_id hostname against private IP ranges but does not apply the same validation after HTTP redirects. The practical impact is limited. The attacker cannot read the response body from the internal request, cannot control request headers or method, and the feature must be explicitly enabled via an experimental flag that is off by default. Deployments that restrict allowedClientIdPatterns to specific trusted domains are not affected. Patched in @backstage/plugin-auth-backend version 0.27.1.

1.7 CVSS 4.0 Low EPSS 0.47% · top 61.9% CWE-918 · Server-side request forgery (SSRF)
1.7CVSS 4.0 base score
0.47%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

Backstage is an open framework for building developer portals. Prior to 0.27.1, a Server-Side Request Forgery (SSRF) vulnerability exists in @backstage/plugin-auth-backend when auth.experimentalClientIdMetadataDocuments.enabled is set to true. The CIMD metadata fetch validates the initial client_id hostname against private IP ranges but does not apply the same validation after HTTP redirects. The practical impact is limited. The attacker cannot read the response body from the internal request, cannot control request headers or method, and the feature must be explicitly enabled via an experimental flag that is off by default. Deployments that restrict allowedClientIdPatterns to specific trusted domains are not affected. Patched in @backstage/plugin-auth-backend version 0.27.1.

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/backstage/backstage/commit/17038abf2dfdb4abc08a59b1c95af39851de0e07 Patch
https://github.com/backstage/backstage/security/advisories/GHSA-qp4c-xg64-7c6x Vendor Advisory

Track CVE-2026-32236 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.9CVE-2023-35926Linuxfoundation backstage code injection vulnerabilityBackstage is an open platform for building developer portals. The Backstage scaffolder-backend plugin uses a templating library that requires sandbox…EPSS 1.9%8.8CVE-2026-25153Linuxfoundation backstage code injection vulnerabilityBackstage is an open framework for building developer portals, and @backstage/plugin-techdocs-node provides common node.js functionalities for TechDo…EPSS 0.62%8.5CVE-2021-43783Linuxfoundation backstage path traversal vulnerability@backstage/plugin-scaffolder-backend is the backend for the default Backstage software templates. In affected versions a malicious actor with write a…EPSS 1.2%6.5CVE-2026-25152Linuxfoundation backstage path traversal vulnerabilityBackstage is an open framework for building developer portals, and @backstage/plugin-techdocs-node provides common node.js functionalities for TechDo…EPSS 0.44%6.5CVE-2024-45815Linuxfoundation backstage prototype pollution vulnerabilityBackstage is an open framework for building developer portals. A malicious actor with authenticated access to a Backstage instance with the catalog b…EPSS 0.51%6.5CVE-2024-45816Linuxfoundation backstage relative path traversal vulnerabilityBackstage is an open framework for building developer portals. When using the AWS S3 or GCS storage provider for TechDocs it is possible to access co…EPSS 0.73%6.5CVE-2021-32662Linuxfoundation backstage path traversal vulnerabilityBackstage is an open platform for building developer portals, and techdocs-common contains common functionalities for Backstage's TechDocs. In `@back…EPSS 1.3%5.7CVE-2023-6944Redhat red hat developer hub error message information leak vulnerabilityA flaw was found in the Red Hat Developer Hub (RHDH). The catalog-import function leaks GitLab access tokens on the frontend when the base64 encoded …EPSS 0.56%

Source: NIST National Vulnerability Database (record CVE-2026-32236), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.