CVE-2026-32236 Details

A Server-Side Request Forgery (SSRF) vulnerability has been identified in the Backstage authentication plugin backend, specifically in versions prior to 0.27.1. This vulnerability arises when the experimental Client ID Metadata Documents feature is enabled. The issue occurs because the metadata fetch process validates the initial client_id hostname against private IP ranges but fails to apply the same validation after HTTP redirects. As a result, an attacker could potentially redirect requests to internal hosts, bypassing the SSRF protections. However, the practical impact is limited, as the attacker cannot read the response body from the internal request, control request headers or methods, and the vulnerable feature must be explicitly enabled via an experimental flag that is off by default. Additionally, deployments that restrict allowedClientIdPatterns to specific trusted domains are not affected.

Users can update to Backstage version 0.27.1 or later, where this vulnerability has been patched. Alternatively, the experimental CIMD feature can be disabled by setting 'auth.experimentalClientIdMetadataDocuments.enabled' to false in the app configuration. For deployments that require the feature, restricting 'allowedClientIdPatterns' to trusted domains can also mitigate the risk.