CVE-2026-24048
SSRF in Backstage FetchUrlReader Allows Internal URL Bypass
Publication date: 2026-01-21
Last updated on: 2026-04-25
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linuxfoundation | backstage/backend_defaults | to 0.12.2 (exc) |
| linuxfoundation | backstage/backend_defaults | From 0.13.0 (inc) to 0.13.2 (inc) |
| linuxfoundation | backstage/backend_defaults | From 0.14.0 (inc) to 0.14.1 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-918 | The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Server-Side Request Forgery (SSRF) issue in the Backstage backend framework's FetchUrlReader component. Before certain fixed versions, the component automatically followed HTTP redirects, which allowed an attacker controlling a host listed in the backend.reading.allow configuration to redirect requests to internal or sensitive URLs not on the allowlist. This bypasses the URL allowlist security control, potentially exposing internal resources. However, attackers cannot add extra request headers.
How can this vulnerability impact me? :
The vulnerability can allow an attacker to access internal or sensitive resources by redirecting requests through a trusted host, bypassing security controls. This could lead to unauthorized access to internal systems or data that should be protected, potentially exposing sensitive information or internal services.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade @backstage/backend-defaults to version 0.12.2, 0.13.2, 0.14.1, or 0.15.0 or later. Additionally, restrict the backend.reading.allow configuration to only trusted hosts that you control and that do not issue redirects. Ensure that allowed hosts do not have open redirect vulnerabilities. You can also implement network-level controls to block access from Backstage to sensitive internal endpoints.