Server-Side Request Forgery in Backstage's FetchUrlReader Component
CVE-2026-24048

3.5LOW

Key Information:

Vendor

Backstage

Status
Backstage
Vendor
CVE Published:
21 January 2026

What is CVE-2026-24048?

The FetchUrlReader component in Backstage versions before 0.12.2, 0.13.2, 0.14.1, and 0.15.0 contains a vulnerability that allows an attacker controlling a host in the backend.reading.allow list to exploit HTTP redirects automatically. This can lead to unauthorized access to internal or sensitive URLs beyond designated allowlists. Mitigations include upgrading to the patched versions, implementing strict controls on allowed hosts to prevent open redirect vulnerabilities, and using network-level defenses to limit access to critical internal resources.

Affected Version(s)

backstage < 0.12.2 < 0.12.2

backstage >= 0.13.0, < 0.13.2 < 0.13.0, 0.13.2

backstage >= 0.14.0, < 0.14.1 < 0.14.0, 0.14.1

References

https://github.com/backstage/backstage/security/advisorie...
x_refsource_CONFIRM
https://github.com/backstage/backstage/commit/27f9061d24a...
x_refsource_MISC

CVSS V3.1

Score:
3.5
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.