Is CVE-2026-32236 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-32236 being exploited in the wild.

How severe is CVE-2026-32236?

Medium severity, with a CVSS score of 4, published 12 March 2026.

Which products and versions are affected?

Backstage Auth Backend Plugin < 0.27.1; @backstage/plugin-auth-backend (npm) < 0.27.1, SEMVER:introduced=0,fixed=0.27.1.

Is there a fix for CVE-2026-32236?

Yes. @backstage/plugin-auth-backend (npm): upgrade to 0.27.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-32236 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-32236?

Check whether you run Backstage Auth Backend Plugin or @backstage/plugin-auth-backend (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-32236: Backstage auth-backend SSRF in CIMD metadata fetch

Q: Is there a fix for CVE-2026-32236?

Yes. @backstage/plugin-auth-backend (npm): upgrade to 0.27.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-32236 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-32236?

Check whether you run Backstage Auth Backend Plugin or @backstage/plugin-auth-backend (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-32236 · Severity: medium · CVSS 4 · Published 2026-03-12

A security vulnerability exists in the Backstage authentication plugin, which is used to manage developer portal access. Under specific experimental configurations, an attacker could trick the server into making unauthorized requests to internal network locations. While the impact is limited because the attacker cannot see the response data, it could still be used to probe internal infrastructure or bypass certain network restrictions.

Technologies: @backstage/plugin-auth-backend (npm). Vendors: Backstage, npm.

Quick answers

Is CVE-2026-32236 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-32236 being exploited in the wild.
How severe is CVE-2026-32236?: Medium severity, with a CVSS score of 4, published 12 March 2026.
Which products and versions are affected?: Backstage Auth Backend Plugin < 0.27.1; @backstage/plugin-auth-backend (npm) < 0.27.1, SEMVER:introduced=0,fixed=0.27.1.
Is there a fix for CVE-2026-32236?: Yes. @backstage/plugin-auth-backend (npm): upgrade to 0.27.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-32236 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-32236?: Check whether you run Backstage Auth Backend Plugin or @backstage/plugin-auth-backend (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@backstage/plugin-auth-backend (npm): upgrade to 0.27.1 or later
```
npm install @backstage/plugin-auth-backend@0.27.1
```

Technical details

A Server-Side Request Forgery (SSRF) vulnerability (CWE-918) exists in the `@backstage/plugin-auth-backend` package. The vulnerability occurs within the Client ID Metadata Document (CIMD) fetch mechanism. While the system validates the initial `client_id` hostname against private IP ranges, it fails to perform the same validation on subsequent HTTP redirects. An attacker can exploit this by providing a URL that redirects to an internal or restricted IP address. The impact is mitigated by the fact that the feature is experimental and disabled by default, and the attacker cannot read the response body or control request headers. The issue is fixed in version 0.27.1 by disabling redirect following during CIMD metadata fetches.

Affected products

Backstage @backstage/plugin-auth-backend < 0.27.1

Identifiers

CVE-2026-32236
GHSA-qp4c-xg64-7c6x

Timeline

2026-03-11: disclosed: Advisory published by maintainers
2026-03-12: advisory: GitHub Advisory published
2026-03-12: patched: Version 0.27.1 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.