PT-2026-25052 · Npm+3 · @Backstage/Plugin-Auth-Backend+2

Benjdlambert · Published 2026-03-12 · Updated 2026-03-12 · CVE-2026-32236

Positive Technologies (AI Summary)

CVSS v4.0

1.7

Low

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 0.27.1

Description Backstage is an open framework for building developer portals. A Server-Side Request Forgery (SSRF) issue exists in the @backstage/plugin-auth-backend component when the auth.experimentalClientIdMetadataDocuments.enabled setting is enabled. The component validates the initial client id hostname against private IP ranges, but this validation is not applied after HTTP redirects. The impact is limited as an attacker cannot read the response body, control request headers, or the request method. The feature is disabled by default and deployments restricting allowedClientIdPatterns to trusted domains are not affected.

Recommendations Versions prior to 0.27.1: Update to version 0.27.1 or later. Versions prior to 0.27.1: Disable the experimental CIMD feature by setting auth.experimentalClientIdMetadataDocuments.enabled to false in your app-config. Versions prior to 0.27.1: Restrict allowedClientIdPatterns to specific trusted domains.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-32236

GHSA-QP4C-XG64-7C6X

Affected Products

@Backstage/Plugin-Auth-Backend

Backstage

Plugin-Auth-Backend

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32236.json · Exploit
• https://github.com/backstage/backstage/security/advisories/GHSA-qp4c-xg64-7c6x · Vendor Advisory
• https://github.com/backstage/backstage/commit/17038abf2dfdb4abc08a59b1c95af39851de0e07 · Patch
• https://osv.dev/vulnerability/GHSA-qp4c-xg64-7c6x · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32236 · Security Note
• https://osv.dev/vulnerability/CVE-2026-32236 · Vendor Advisory
• https://github.com/backstage/backstage · Note
• https://twitter.com/CVEnew/status/2032230672522219794 · Twitter Post