CVE-2026-32236: SSRF Vulnerability in @backstage/plugin-auth-backend
Summary
CVE-2026-32236: @backstage/plugin-auth-backend: SSRF in experimental CIMD metadata fetch. Affects @backstage/plugin-auth-backend versions < 0.27.1. Fixed in 0.27.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @backstage/plugin-auth-backend package is a component of the Backstage framework, which is designed to streamline the development of developer portals. This plugin facilitates authentication processes by managing client ID metadata documents. However, it has been identified to have a Server-Side Request Forgery (SSRF) vulnerability when certain experimental features are enabled.
Vulnerability Detail
A Server-Side Request Forgery (SSRF) vulnerability exists in the @backstage/plugin-auth-backend package when the configuration option auth.experimentalClientIdMetadataDocuments.enabled is set to true. This vulnerability arises because the CIMD metadata fetch process validates the initial client_id hostname against private IP ranges but fails to apply the same validation after HTTP redirects. Although the practical impact is limited, as attackers cannot read the response body from internal requests or control request headers or methods, the feature must be explicitly enabled, making it a potential risk for misconfigured deployments.
How To Fix
Latest published version: 0.30.2 as of 22 Oct 2026
npm install @backstage/plugin-auth-backend@0.30.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.27.1
This is the first release that contains the fix.
npm install @backstage/plugin-auth-backend@0.27.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, disable the experimental CIMD feature by setting the following configuration in your app-config: auth.experimentalClientIdMetadataDocuments.enabled: false. This is the default configuration. Additionally, consider restricting allowedClientIdPatterns to specific trusted domains instead of using the default wildcard pattern.
Conclusion
The SSRF vulnerability in @backstage/plugin-auth-backend (CVE-2026-32236) poses a risk when the experimental feature is enabled. It is crucial to update to the patched version or implement workarounds to mitigate potential risks. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for @backstage/plugin-auth-backend →
FAQ
Server-Side Request Forgery (SSRF) is a security vulnerability that allows an attacker to send crafted requests from a vulnerable server to internal or external resources.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
While the practical impact is limited, it could allow an attacker to exploit misconfigured deployments, especially if the experimental feature is enabled.
Yes, the vulnerability has been patched in version 0.27.1 of the @backstage/plugin-auth-backend package.
If immediate updates are not possible, disable the experimental feature or restrict allowedClientIdPatterns to trusted domains as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for @backstage/plugin-auth-backend.
