CVE-2026-32236

Backstage is an open framework for building developer portals. Prior to 0.27.1, a Server-Side Request Forgery (SSRF) vulnerability exists in @backstage/plugin-auth-backend when auth.experimentalClientIdMetadataDocuments.enabled is set to true. The CIMD metadata fetch validates the initial client_id hostname against private IP ranges but does not apply the same validation after HTTP redirects. The practical impact is limited. The attacker cannot read the response body from the internal request, cannot control request headers or method, and the feature must be explicitly enabled via an experimental flag that is off by default. Deployments that restrict allowedClientIdPatterns to specific trusted domains are not affected. Patched in @backstage/plugin-auth-backend version 0.27.1.

• CWE-918

• https://github.com/backstage/backstage/commit/17038abf2dfdb4abc08a59b1c95af39851de0e07Patch
• https://github.com/backstage/backstage/security/advisories/GHSA-qp4c-xg64-7c6xVendor Advisory

Published

Mar 12, 2026

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-3223Arbitrary file write & potential privilege escalation exploi…7.8
• CVE-2026-32230Uptime Kuma is an open source, self-hosted monitoring tool. …5.3
• CVE-2026-32231ZeptoClaw is a personal AI assistant. Prior to 0.7.6, the ge…8.2
• CVE-2026-32232ZeptoClaw is a personal AI assistant. Prior to 0.7.6, there …9.8
• CVE-2026-32234Parse Server is an open source backend that can be deployed …4.7
• CVE-2026-32235Backstage is an open framework for building developer portal…4.7
• CVE-2026-32237Backstage is an open framework for building developer portal…6.5
• CVE-2026-32238OpenEMR is a free and open source electronic health records …9.1
• CVE-2026-32239Cap'n Proto is a data interchange format and capability-base…6.5
• CVE-2026-3224Authentication bypass in the Microsoft Entra ID (Azure AD) a…9.8
• CVE-2026-32240Cap'n Proto is a data interchange format and capability-base…6.5
• CVE-2026-32241Flannel is a network fabric for containers, designed for Kub…8.8