Backstage has a Possible SSRF when reading from allowed URL's in `backend.reading.allow`
Impact
The FetchUrlReader component, used by the catalog and other plugins to fetch content from URLs, followed HTTP redirects automatically. This allowed an attacker who controls a host listed in backend.reading.allow to redirect requests to internal or sensitive URLs that are not on the allowlist, bypassing the URL allowlist security control.
This is a Server-Side Request Forgery (SSRF) vulnerability that could allow access to internal resources, but it does not allow attackers to include additional request headers.
Patches
This vulnerability is fixed in @backstage/backend-defaults version 0.12.2, 0.13.2, 0.14.1, and 0.15.0. Users should upgrade to this version or later.
Workarounds
- Restrict
backend.reading.allowto only trusted hosts that you control and that do not issue redirects - Ensure allowed hosts do not have open redirect vulnerabilities
- Use network-level controls to block access from Backstage to sensitive internal endpoints
References
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | @backstage/backend-defaults | < 0.12.2, >= 0.13.0, < 0.13.2, >= 0.14.0, < 0.14.1 | 0.12.2, 0.13.2, 0.14.1 |
References
- CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N- Weakness (CWE)
CWE-918- Platform
- npm
- Package
@backstage/backend-defaults- Disclosed
- 21.01.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-q2x5-4xjx-c6p9 - CC BY 4.0
Vulnerability history: @backstage/backend-defaults
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 6
- First → latest
- 01.2026 10.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 2
- Medium 2
- Low 2
Disclosures per year
- 2026: 6
-
Backstage has a Possible SSRF when reading from allowed URL's in `backend.reading.allow` this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.