3.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-24048

CVE-2026-24048: Backstage has a Possible SSRF when reading from allowed URL's in `backend.reading.allow`

Backstage is an open framework for building developer portals, and @backstage/backend-defaults provides the default implementations and setup for a standard Backstage backend app. Prior to versions 0.12.2, 0.13.2, 0.14.1, and 0.15.0, the FetchUrlReader component, used by the catalog and other plugins to fetch content from URLs, followed HTTP redirects automatically. This allowed an attacker who controls a host listed in backend.reading.allow to redirect requests to internal or sensitive URLs that are not on the allowlist, bypassing the URL allowlist security control. This is a Server-Side Request Forgery (SSRF) vulnerability that could allow access to internal resources, but it does not allow attackers to include additional request headers. This vulnerability is fixed in @backstage/backend-defaults version 0.12.2, 0.13.2, 0.14.1, and 0.15.0. Users should upgrade to this version or later. Some workarounds are available. Restrict backend.reading.allow to only trusted hosts that you control and that do not issue redirects, ensure allowed hosts do not have open redirect vulnerabilities, and/or use network-level controls to block access from Backstage to sensitive internal endpoints.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-24048

CVE-2026-24048:

3.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@backstage/backend-defaults	npm	< 0.12.2	0.12.2
@backstage/backend-defaults	npm	>= 0.13.0, < 0.13.2	0.13.2
@backstage/backend-defaults	npm	>= 0.14.0, < 0.14.1	0.14.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Server-Side Request Forgery (SSRF) in the FetchUrlReader component of Backstage. The root cause was the automatic following of HTTP redirects by the underlying fetch library. The backend.reading.allow configuration was only checked for the initial URL, not for any subsequent URLs in a redirect chain.

The analysis of the patch commit 27f9061d24affd1b9212fe0abd476bfc3fbaedcb confirms this. The core of the patch is in the packages/backend-defaults/src/entrypoints/urlReader/lib/FetchUrlReader.ts file.

The function FetchUrlReader.readUrl was completely refactored. The original implementation made a single fetch call, relying on its default behavior to follow redirects. The patched version introduces a loop to manually handle redirects. It sets redirect: 'manual' in the fetch options and, upon receiving a redirect status code, it checks the location header. Crucially, before fetching the next URL in the chain, it validates it against the backend.reading.allow list using a predicate function.

The primary vulnerable function is FetchUrlReader.readUrl, as it contained the flawed fetching logic. The FetchUrlReader.read function is also identified as vulnerable because it's a public entry point that directly calls readUrl. During an exploit, a profiler would likely show both FetchUrlReader.read and FetchUrlReader.readUrl in the stack trace. The fix ensures that all URLs in a redirect chain are subject to the same security policy, effectively mitigating the SSRF vulnerability.

Vulnerable functions

FetchUrlReader.readUrl

packages/backend-defaults/src/entrypoints/urlReader/lib/FetchUrlReader.ts

This function performs the fetch operation. Before the patch, it automatically followed HTTP redirects without validating the destination URL against the configured `backend.reading.allow` list. This allowed an attacker to craft a response from an allowed host that redirects to an internal or otherwise restricted URL, leading to an SSRF vulnerability.

FetchUrlReader.read

packages/backend-defaults/src/entrypoints/urlReader/lib/FetchUrlReader.ts

This function is a public wrapper around the vulnerable `readUrl` function. An exploit would likely trigger this function, which in turn calls the `readUrl` implementation that contained the vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.