CVE-2026-32236: SSRF in @backstage/plugin-auth-backend

The SSRF vulnerability arises from insufficient validation of hostnames after HTTP redirects within the Client Identity Metadata Documents (CIMD) fetching process. When auth.experimentalClientIdMetadataDocuments.enabled is set to true, the plugin attempts to fetch metadata, but the validation of the initial client_id hostname against private IP ranges is bypassed after redirects. This allows an attacker to craft a malicious redirect that points to an internal resource, effectively bypassing the intended security controls. Successful exploitation could lead to unauthorized access to internal services or data, potentially exposing sensitive information or enabling further attacks within the internal network. The impact is limited by the scope of the plugin and the configuration of the auth.experimentalClientIdMetadataDocuments feature.

1. Reserved2026-03-11
2. Published2026-03-12
3. Modified2026-04-15
4. EPSS updated2026-03-23

The primary mitigation for CVE-2026-32236 is to upgrade to @backstage/plugin-auth-backend version 0.27.1 or later, which includes the necessary hostname validation fixes. If upgrading is not immediately feasible, consider disabling the auth.experimentalClientIdMetadataDocuments.enabled feature. This will prevent the vulnerable metadata fetching process from executing. As a temporary workaround, implement a Web Application Firewall (WAF) or proxy rules to filter out requests containing suspicious redirects or internal IP addresses. Monitor logs for unusual outbound requests originating from the plugin.