CVE-2026-24048: 
JavaScript vulnerability analysis and mitigation

CVE-2026-24048 is a Server-Side Request Forgery (SSRF) vulnerability in the @backstage/backend-defaults npm package, specifically in the FetchUrlReader component used by the Backstage developer portal framework. The vulnerability allows an attacker who controls a host listed in backend.reading.allow to bypass the URL allowlist by issuing HTTP redirects to internal or sensitive URLs not on the allowlist. Affected versions include @backstage/backend-defaults < 0.12.2, >= 0.13.0 and < 0.13.2, and >= 0.14.0 and < 0.14.1. It was published on January 21, 2026, with patches released the same day. The CVSS v3.1 base score is 3.5 (Low) per the GitHub Advisory, though NVD records a score of 3.7 (Low) (GitHub Advisory, Backstage Advisory).

The root cause is classified as CWE-918 (Server-Side Request Forgery), arising from the FetchUrlReader component automatically following HTTP redirects without validating the redirect target URL against the configured backend.reading.allow allowlist. An attacker who controls an allowlisted host can serve an HTTP redirect response (e.g., 301/302) pointing to an internal or otherwise restricted URL, causing the Backstage backend to fetch content from that unintended destination. Exploitation requires the attacker to control or compromise a host already present in the backend.reading.allow configuration, which constitutes the primary precondition and contributes to the High attack complexity rating. Notably, the vulnerability does not permit the attacker to inject additional HTTP request headers into the redirected request, limiting the scope of potential abuse. The fix, implemented in commit 27f9061, disables automatic redirect following and instead validates each URL in a redirect chain against the allowlist before proceeding (GitHub Advisory, Patch Commit).

Successful exploitation enables unauthorized access to internal resources reachable by the Backstage backend server, resulting in information disclosure of potentially sensitive internal services (e.g., metadata APIs, internal dashboards, cloud provider instance metadata endpoints). The confidentiality impact is low and scoped to read-only access without the ability to modify data or disrupt availability. However, depending on the internal network topology, this SSRF could facilitate lateral movement by allowing an attacker to probe or access services that are otherwise network-isolated from external actors (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation as of the time of disclosure (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.038% (12th percentile), indicating a low probability of exploitation in the near term (GitHub Advisory). Exploitation requires the attacker to already control or have compromised a host listed in the victim's backend.reading.allow configuration, which significantly raises the bar for exploitation.

1. Identify a target: Locate a Backstage instance running a vulnerable version of @backstage/backend-defaults (< 0.12.2, >= 0.13.0 and < 0.13.2, or >= 0.14.0 and < 0.14.1) with a known or discoverable backend.reading.allow configuration.
2. Control an allowlisted host: Gain control of, or compromise, a host that is listed in the target Backstage instance's backend.reading.allow configuration (e.g., through a subdomain takeover, compromised third-party service, or social engineering to get a malicious host added).
3. Set up a redirect: Configure the controlled host to respond to HTTP requests with a redirect (HTTP 301/302) pointing to a target internal URL (e.g., http://169.254.169.254/latest/meta-data/ for cloud instance metadata, or an internal API endpoint).
4. Trigger a fetch: Cause the Backstage backend to fetch a URL from the controlled allowlisted host — for example, by adding a catalog entity or scaffolder template that references a URL on the attacker-controlled host.
5. Receive internal content: The vulnerable FetchUrlReader automatically follows the redirect to the internal URL without re-validating it against the allowlist, and the response content from the internal resource is returned to the attacker (GitHub Advisory, Backstage Advisory).

• Network: Outbound HTTP requests from the Backstage backend server to unexpected internal IP ranges (e.g., RFC 1918 addresses, 169.254.169.254) or internal hostnames not present in backend.reading.allow.
• Network: HTTP redirect chains observed in Backstage backend network traffic where the final destination differs from the initially requested allowlisted host.
• Logs: Backstage backend logs showing URL fetch activity to internal endpoints or cloud metadata services that are not explicitly configured in backend.reading.allow.
• Logs: Unusual or unexpected entries in access logs of internal services (e.g., metadata APIs, internal dashboards) originating from the Backstage server's IP address.

Upgrade @backstage/backend-defaults to one of the patched versions: 0.12.2, 0.13.2, 0.14.1, or 0.15.0 (or later), which disable automatic HTTP redirect following and validate redirect targets against the allowlist (GitHub Advisory, Patch Commit). If immediate upgrade is not possible, apply the following workarounds:

• Restrict backend.reading.allow to only trusted hosts that you directly control and that are confirmed not to issue redirects.
• Audit all allowlisted hosts for open redirect vulnerabilities.
• Implement network-level egress controls on the Backstage server to block outbound access to sensitive internal endpoints (e.g., cloud metadata services, internal APIs).

The advisory was published by Backstage maintainer Rugvip on January 21, 2026, and the fix was contributed via a fork merge (Backstage Advisory). The vulnerability received coverage from automated vulnerability tracking services and a brief mention on Bluesky's CVE tracking account shortly after disclosure. No significant independent researcher commentary or major media coverage has been identified beyond standard vulnerability database aggregation.