CVE-2026-106556
Backstage is an open framework for building developer portals
- Risk score
- 50/100
- CVSS
- 7.7 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 7 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by configuration bypass in techdocs mkdocs.yml sanitization. Insufficient validation of MkDocs configuration during TechDocs generation could allow an authenticated user who can regis…
- Affected
- Linuxfoundation Backstage before 1.14.6, 1.15.4
- Fix
- Upgrade Linuxfoundation Backstage to 1.14.6 or 1.15.4 (whichever matches your release line), or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 7.7 high
References
- https://github.com/backstage/backstage/commit/25125ee727a3de3418a8fa6a9e458cd5b73ecf26
- https://github.com/backstage/backstage/commit/b6d1aea0bef99b8dfec3c8746032474867ba677a
- https://github.com/backstage/backstage/releases/tag/v1.50.5
- https://github.com/backstage/backstage/releases/tag/v1.54.6
- https://github.com/backstage/backstage/security/advisories/GHSA-g2hj-v2j6-vfvg
Original description
Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by configuration bypass in techdocs mkdocs.yml sanitization. Insufficient validation of MkDocs configuration during TechDocs generation could allow an authenticated user who can register or modify documentation sources to execute arbitrary commands in the build environment. Impact is limited to resources accessible to the TechDocs backend or build container. This issue is fixed in versions 1.14.6 and 1.15.4.
Last activity 7 Oct 2026. Patch Forecast updates every hour.