PT-2026-3880 · Netflix · Backstage+1
Rugvip
·
Published
2026-01-21
·
Updated
2026-01-21
·
CVE-2026-24048
CVSS v3.1
3.7
Low
| Vector | AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Backstage versions prior to 0.12.2
Backstage versions prior to 0.13.2
Backstage versions prior to 0.14.1
Backstage versions prior to 0.15.0
Description
The
FetchUrlReader component in Backstage’s @backstage/backend-defaults automatically followed HTTP redirects. This allowed an attacker controlling a host listed in backend.reading.allow to redirect requests to internal or sensitive URLs not on the allowlist, bypassing URL allowlist security controls. This is a Server-Side Request Forgery (SSRF) condition that could allow access to internal resources, but it does not allow attackers to include additional request headers. The vulnerable component is used by the catalog and other plugins to fetch content from URLs.Recommendations
Upgrade to Backstage version 0.12.2 or later.
Upgrade to Backstage version 0.13.2 or later.
Upgrade to Backstage version 0.14.1 or later.
Upgrade to Backstage version 0.15.0 or later.
Restrict
backend.reading.allow to only trusted hosts that you control and that do not issue redirects.
Ensure allowed hosts do not have open redirect vulnerabilities.
Use network-level controls to block access from Backstage to sensitive internal endpoints.Exploit
Fix
SSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
@Backstage/Backend-Defaults
Backstage