CVE-2026-32236: 
JavaScript vulnerability analysis and mitigation

CVE-2026-32236 is a Server-Side Request Forgery (SSRF) vulnerability in the @backstage/plugin-auth-backend npm package, specifically in the experimental Client ID Metadata Document (CIMD) metadata fetch feature. The vulnerability affects versions up to and including 0.27.0 of the package and is only exploitable when auth.experimentalClientIdMetadataDocuments.enabled is set to true (disabled by default). It was published on March 11, 2026, by benjdlambert and added to the GitHub Advisory Database on March 12, 2026. The CVSS v3.1 base score is 7.5 (High) per NVD, though the GitHub advisory rates it Low (CVSS v4 score of 1.7) due to significant practical limitations (Github Advisory, Backstage Advisory).

The root cause is CWE-918 (Server-Side Request Forgery), arising from incomplete validation of redirect targets in the CIMD metadata fetch logic. The fetchCimdMetadata function in CimdClient.ts validates the initial client_id hostname against private IP ranges, but when the external server responds with an HTTP redirect (e.g., a 302 to http://127.0.0.1:8080/internal), the redirect target is followed without re-applying the private IP blocklist. An attacker can craft a client_id pointing to an attacker-controlled server that issues a redirect to an internal host, causing the Backstage backend to make an unauthenticated GET request to that internal resource. The fix, applied in commit 17038ab, sets redirect: 'error' in the fetch options to disable redirect following entirely (Backstage Advisory, Patch Commit).

Successful exploitation allows an unauthenticated attacker to cause the Backstage backend server to issue GET requests to internal network resources that would otherwise be inaccessible from the public internet. However, practical impact is significantly constrained: the attacker cannot read the response body of the internal request, cannot control request headers or the HTTP method, and the feature must be explicitly enabled via an opt-in experimental flag. Deployments that restrict allowedClientIdPatterns to specific trusted domains are not affected at all, further limiting the exploitable attack surface (Github Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure. The EPSS score is approximately 0.047% (15th percentile), indicating a very low probability of exploitation in the near term. No threat actor attribution has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the target deployment to have explicitly enabled the experimental auth.experimentalClientIdMetadataDocuments feature, which is off by default, substantially reducing the number of vulnerable targets (Github Advisory).

1. Identify a vulnerable target: Locate a Backstage deployment running @backstage/plugin-auth-backend version ≤ 0.27.0 with auth.experimentalClientIdMetadataDocuments.enabled: true in its app-config.yaml, and with allowedClientIdPatterns set to a wildcard or permissive pattern.
2. Set up a redirect server: Host an attacker-controlled HTTPS server at a publicly routable domain (e.g., https://attacker.example.com/metadata.json) that responds to GET requests with an HTTP 302 redirect pointing to a target internal resource (e.g., Location: http://169.254.169.254/latest/meta-data/ for cloud metadata, or http://192.168.1.1/admin).
3. Submit the malicious client_id: Trigger the CIMD metadata fetch by supplying the attacker-controlled URL as the client_id in an OAuth/authentication flow request to the Backstage auth backend endpoint.
4. SSRF redirect bypass: The Backstage server validates the initial hostname (attacker.example.com) as non-private and proceeds to fetch it. The redirect to the internal IP is followed without re-validation, causing the server to issue a GET request to the internal resource.
5. Observe side effects: While the attacker cannot read the response body, they may infer reachability of internal hosts via timing differences, error messages, or server-side logs if accessible (Backstage Advisory, Patch Commit).

• Network: Outbound GET requests from the Backstage server to internal IP ranges (RFC 1918: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or link-local addresses (169.254.0.0/16) originating from the auth-backend process.
• Network: Outbound HTTP requests to cloud instance metadata endpoints (e.g., http://169.254.169.254/) from the Backstage host.
• Logs: Backstage auth-backend logs showing CIMD metadata fetch attempts for client_id values pointing to external domains that subsequently redirect to internal hosts.
• Logs: HTTP 302 redirect responses logged from external hosts during CIMD metadata fetch operations, followed by connection attempts to internal addresses.
• Logs: InputError: Failed to fetch client metadata errors in auth-backend logs (post-patch behavior) that may indicate attempted exploitation against a patched instance.

Upgrade @backstage/plugin-auth-backend to version 0.27.1 or later, which disables HTTP redirect following during CIMD metadata fetches (redirect: 'error'). If immediate patching is not possible, disable the experimental feature by setting auth.experimentalClientIdMetadataDocuments.enabled: false (or removing the setting entirely, as this is the default). As an additional defense-in-depth measure, restrict allowedClientIdPatterns to specific trusted domains rather than using a wildcard pattern, which prevents exploitation regardless of the redirect behavior (Github Advisory, Patch Commit).