CVE-2026-106455 · GHSA-q38j-6vcm-2f5m
Backstage: Improper validation of MkDocs plugin configuration in TechDocs
- Risk score
- 56/100
- CVSS
- 7.7 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 6 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Backstage is an open framework for building developer portals. From 0.11.12 until 1.14.7 and 1.15.5, the @backstage/plugin-techdocs-node package is affected by improper validation of mkdocs plugin configuration in techdocs. An authenticated attacker with control over a TechDocs source repository could cause a document…
- Affected
- @backstage/plugin-techdocs-node (npm) >= 0.11.12, < 1.14.7; @backstage/plugin-techdocs-node (npm) >= 1.15.0, < 1.15.5
- Fix
- Upgrade @backstage/plugin-techdocs-node to 1.14.7 or 1.15.5 (whichever matches your release line) or later.
- Exploitation
- No known exploitation
Story map
At a glance
@backstage/plugin-techdocs-node: Amber, patch this week. Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by improper validation of mkdocs theme configuration in techdocs. When TechDocs is configured to build documentation locally or in a container, a user with write access to a registere…
The flaws
- CVE-2026-106455: Backstage: Improper validation of MkDocs plugin configuration in TechDocs (CVSS 7.7 · EPSS 0%)
- CVE-2026-106509: Backstage: Improper validation of MkDocs theme configuration in TechDocs (CVSS 8.8 · EPSS 0%)
- CVE-2026-106558: Backstage: Improper validation of TechDocs MkDocs configuration (CVSS 8.8 · EPSS 0%)
- CVE-2026-106505: Backstage: Bypass of MkDocs configuration sanitizer in TechDocs backend (CVSS 8.5 · EPSS 0%)
The fix
Upgrade @backstage/plugin-techdocs-node: 1.14.6 · 1.15.4 · 1.14.8 · 1.15.6 · 2.0.1 or later on your release line
Who is exposed: @backstage/plugin-techdocs-node (npm) < 1.15.4
Where it stands
- Public proof of concept
Connects to
- Same weakness: Server-side request forgery (CWE-918). 223 other warnings in 30 days
- Same product: Earlier @backstage/plugin-techdocs-node warnings. 3 in the last 90 days
Why it is Yellow
- CVSS 7.7 high
- On your watchlist: npm
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| @backstage/plugin-techdocs-node | npm | >= 0.11.12, < 1.14.7 | 1.14.7 |
| @backstage/plugin-techdocs-node | npm | >= 1.15.0, < 1.15.5 | 1.15.5 |
References
- https://github.com/advisories/GHSA-q38j-6vcm-2f5m
- https://github.com/backstage/backstage/security/advisories/GHSA-q38j-6vcm-2f5m
- https://nvd.nist.gov/vuln/detail/CVE-2026-106455
- https://github.com/backstage/backstage/commit/28aa82ae2815988721dd7bbf43cd69c431dcd71b
- https://github.com/backstage/backstage/commit/9f76ea445088961f68c364764cc4b7734f368fc0
- https://github.com/backstage/backstage/releases/tag/v1.50.6
- https://github.com/backstage/backstage/releases/tag/v1.54.8
- https://github.com/backstage/backstage/releases/tag/v1.55.0
- https://github.com/advisories/GHSA-q38j-6vcm-2f5m
Original description
Backstage is an open framework for building developer portals. From 0.11.12 until 1.14.7 and 1.15.5, the @backstage/plugin-techdocs-node package is affected by improper validation of mkdocs plugin configuration in techdocs. An authenticated attacker with control over a TechDocs source repository could cause a documentation build to retrieve and publish data from network locations reachable by the build environment. Exposure depends on deployment topology, build mode, and target endpoint protections. Modern cloud metadata services that require tokens or special headers are not directly accessible through the affected behavior. This issue is fixed in @backstage/plugin-techdocs-node versions 1.14.7 and 1.15.5.
Last activity 6 Oct 2026. Patch Forecast updates every hour.