GHSA-qp4c-xg64-7c6x

Source

https://github.com/advisories/GHSA-qp4c-xg64-7c6x

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-qp4c-xg64-7c6x/GHSA-qp4c-xg64-7c6x.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-qp4c-xg64-7c6x

Aliases

CVE-2026-32236

Published

2026-03-12T14:51:02Z

Modified

2026-04-15T21:03:48Z

Severity

1.7 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U CVSS Calculator

Summary

@backstage/plugin-auth-backend: SSRF in experimental CIMD metadata fetch

Details

Impact

A Server-Side Request Forgery (SSRF) vulnerability exists in @backstage/plugin-auth-backend when auth.experimentalClientIdMetadataDocuments.enabled is set to true. The CIMD metadata fetch validates the initial client_id hostname against private IP ranges but does not apply the same validation after HTTP redirects.

The practical impact is limited. The attacker cannot read the response body from the internal request, cannot control request headers or method, and the feature must be explicitly enabled via an experimental flag that is off by default. Deployments that restrict allowedClientIdPatterns to specific trusted domains are not affected.

Patches

Patched in @backstage/plugin-auth-backend version 0.27.1. The fix disables HTTP redirect following when fetching CIMD metadata documents.

Workarounds

Disable the experimental CIMD feature by removing or setting auth.experimentalClientIdMetadataDocuments.enabled to false in your app-config. This is the default configuration. Alternatively, restrict allowedClientIdPatterns to specific trusted domains rather than using the default wildcard pattern.

References

Database specific

{
    "cwe_ids":  [
        "CWE-918"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-03-12T14:51:02Z",
    "nvd_published_at":  "2026-03-12T19:16:18Z",
    "severity":  "LOW"
}

References

Affected packages

npm / @backstage/plugin-auth-backend

Package

Name: @backstage/plugin-auth-backend; View open source insights on deps.dev
Purl: pkg:npm/%40backstage/plugin-auth-backend

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.27.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-qp4c-xg64-7c6x/GHSA-qp4c-xg64-7c6x.json"