Merge commit from fork

* fix: prevent SSRF via redirect in CIMD metadata fetch * fix: prevent SSRF via redirect in CIMD metadata fetch * fix: add redirect target listener to SSRF redirect test
2026-03-11 13:34:25 +01:00
parent 4f5ed06dd1
commit e9b6e978f1
3 changed files with 42 additions and 0 deletions
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-auth-backend': patch
+---
+
+Fixed a security vulnerability where the CIMD metadata fetch could follow HTTP redirects to internal hosts, bypassing SSRF protections.