CVE-2026-29186
Configuration Bypass in Backstage TechDocs Enables Arbitrary Code Execution
Publication date: 2026-03-07
Last updated on: 2026-03-11
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linuxfoundation | backstage_plugin-techdocs-node | to 1.14.3 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-434 | The product allows the upload or transfer of dangerous file types that are automatically processed within its environment. |
| CWE-74 | The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': 'CVE-2026-29186 is a high-severity vulnerability in the @backstage/plugin-techdocs-node package, affecting versions up to 1.14.2. It is a configuration bypass vulnerability in the TechDocs MkDocs plugin, which uses an allowlist to filter dangerous MkDocs configuration keys during the documentation build process.'}, {'type': 'paragraph', 'content': "A gap in this allowlist allows attackers to craft a malicious mkdocs.yml file that triggers arbitrary Python code execution, completely bypassing TechDocs' security controls."}, {'type': 'paragraph', 'content': 'This enables remote attackers with low privileges and no user interaction to execute arbitrary code, impacting components beyond the vulnerable plugin.'}] [1]
How can this vulnerability impact me? :
This vulnerability allows an attacker to execute arbitrary Python code remotely with low privileges and no user interaction.
The impact includes a high confidentiality breach, as attackers can potentially access sensitive information.
Integrity and availability impacts are low, but the scope change means components beyond the vulnerable plugin can be affected.
- Attackers can bypass security controls in TechDocs.
- Potential unauthorized access or manipulation of system components.
- Possible disruption or compromise of documentation build processes.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'Detection of this vulnerability involves identifying the presence of the vulnerable @backstage/plugin-techdocs-node package version (up to 1.14.2) and inspecting mkdocs.yml files for malicious configurations that exploit the allowlist gap.'}, {'type': 'paragraph', 'content': 'Suggested detection steps include:'}, {'type': 'list_item', 'content': 'Check the installed version of @backstage/plugin-techdocs-node to see if it is below 1.14.3.'}, {'type': 'list_item', 'content': 'Review mkdocs.yml files in your repositories for suspicious or unusual hook configurations that could trigger arbitrary Python code execution.'}, {'type': 'list_item', 'content': 'Implement manual pull request reviews specifically targeting changes to mkdocs.yml files to detect potentially malicious modifications.'}, {'type': 'paragraph', 'content': 'While no specific commands are provided in the resources, typical commands might include:'}, {'type': 'list_item', 'content': 'npm list @backstage/plugin-techdocs-node'}, {'type': 'list_item', 'content': "grep -r 'hooks' path/to/mkdocs.yml or similar searches to find suspicious hook usage."}] [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps for this vulnerability include:
- Upgrade the @backstage/plugin-techdocs-node package to version 1.14.3 or later, where the vulnerability is patched.
- Configure TechDocs to run in Docker mode (runIn: docker) instead of local mode to provide container isolation, although this does not fully mitigate the risk.
- Restrict repository access to limit who can modify mkdocs.yml files, allowing only trusted contributors to make changes.
- Implement manual pull request reviews for mkdocs.yml changes to detect and prevent malicious hook configurations.
- Consider downgrading MkDocs to versions below 1.4.0 (e.g., 1.3.1), which do not support hooks, though this limits access to newer MkDocs features.