{"action":"Upgrade @backstage/backend-defaults to 0.12.2 or later.","affected":[{"fixed":"0.12.2","introduced":"0"},{"fixed":"0.13.2","introduced":"0.13.0"},{"fixed":"0.14.1","introduced":"0.14.0"}],"component":"@backstage/backend-defaults","cve_ids":["CVE-2026-24048"],"ecosystem":"npm","epss":0.00235,"exploited":false,"fixed_versions":["0.12.2","0.13.2","0.14.1"],"ghsa_id":"GHSA-q2x5-4xjx-c6p9","id":"tcs_01M5KG4WC4XS75S5EAFCDT3CEY","modified_at":"2026-02-03T03:10:27.142022Z","published_at":"2026-01-21T22:49:37Z","references":["https://osv.dev/vulnerability/GHSA-q2x5-4xjx-c6p9","https://github.com/backstage/backstage/security/advisories/GHSA-q2x5-4xjx-c6p9","https://nvd.nist.gov/vuln/detail/CVE-2026-24048","https://github.com/backstage/backstage/commit/27f9061d24affd1b9212fe0abd476bfc3fbaedcb","https://github.com/backstage/backstage"],"severity":{"label":"low","score":3.5},"sources":[{"source":"osv","source_id":"GHSA-q2x5-4xjx-c6p9","url":"https://osv.dev/vulnerability/GHSA-q2x5-4xjx-c6p9"}],"summary":"Backstage has a Possible SSRF when reading from allowed URL's in `backend.reading.allow`"}