CVE-2026-106455

Analyzed Analyzed - Analysis Complete

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-13

Assigner: GitHub, Inc.

Description

Backstage is an open framework for building developer portals. From 0.11.12 until 1.14.7 and 1.15.5, the @backstage/plugin-techdocs-node package is affected by improper validation of mkdocs plugin configuration in techdocs. An authenticated attacker with control over a TechDocs source repository could cause a documentation build to retrieve and publish data from network locations reachable by the build environment. Exposure depends on deployment topology, build mode, and target endpoint protections. Modern cloud metadata services that require tokens or special headers are not directly accessible through the affected behavior. This issue is fixed in @backstage/plugin-techdocs-node versions 1.14.7 and 1.15.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-13

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-106455

Affected Vendors & Products

Vendor	Product	Version / Range
linuxfoundation	backstage_plugin-techdocs-node	From 0.11.12 (inc) to 1.14.7 (exc)
linuxfoundation	backstage_plugin-techdocs-node	From 1.15.0 (inc) to 1.15.5 (exc)
linuxfoundation	backstage	From 0.71.1 (inc) to 1.50.6 (exc)
linuxfoundation	backstage	1.51.0
linuxfoundation	backstage	1.51.0
linuxfoundation	backstage	1.51.0
linuxfoundation	backstage	1.51.0
linuxfoundation	backstage	From 1.51.1 (inc) to 1.54.8 (exc)
linuxfoundation	backstage	1.51.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

Backstage is an open framework for building developer portals. The vulnerability affects the @backstage/plugin-techdocs-node package between versions 0.11.12 and 1.14.7, and 1.15.5. It involves improper validation of mkdocs plugin configuration in TechDocs, allowing an authenticated attacker with repository control to cause documentation builds to retrieve and publish data from network locations accessible by the build environment.

Detection Guidance

To detect this vulnerability, check if your Backstage instance uses @backstage/plugin-techdocs-node versions between 0.11.12 and 1.14.7 or 1.15.5. Verify the installed version with commands like 'npm list @backstage/plugin-techdocs-node' or 'yarn list @backstage/plugin-techdocs-node'. If the version is within the affected range, update to 1.14.7 or 1.15.5 or later.

Impact Analysis

An attacker could access sensitive data from network locations reachable by the build environment if they control a TechDocs source repository. Exposure depends on deployment setup, build mode, and protections on target endpoints. Modern cloud metadata services requiring tokens or headers are not directly accessible through this vulnerability.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating compliance requirements such as GDPR or HIPAA if protected health or personal data is exposed. Organizations should assess their deployment topology and build modes to mitigate risks.

Mitigation Strategies

Update @backstage/plugin-techdocs-node to version 1.14.7 or 1.15.5 or later to address the improper validation of mkdocs plugin configuration.

Hi! I’m here to help you understand CVE-2026-106455. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70