The FetchUrlReader in @backstage/backend-defaults followed HTTP redirects automatically before certain releases, allowing an attacker controlling a host listed in backend.reading.allow to redirect to internal or sensitive URLs not on the allowlist. This bypasses the URL allowlist security control and results in a Server‑Side Request Forgery that can expose internal resources. The flaw does not allow injection of additional request headers.

Backstage, the open framework for developer portals, and its backend-defaults component are affected. All versions prior to 0.12.2, 0.13.2, 0.14.1, and 0.15.0 of @backstage/backend-defaults contain the vulnerability. Identified through the cpe mapping and vendor/product listing.

The vulnerability has a CVSS v3.1 score of 3.5, placing it in the low severity range. The EPSS indicates an exploitation probability of less than 1%, and the CVE is not listed in the CISA KEV catalog. The explicit lack of support for header manipulation suggests that the attack vector primarily relies on redirect loops from allowed hosts. Given these characteristics, the risk is considered low in environments where allowed hosts can be compromised or are not strictly controlled.