Input validation flaw in Backstage TechDocs Markdown extension config
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 2 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-22 and the CVSS impact.
Summary
Backstage before 1.50.5 and from 1.51.0-next.0 before 1.54.6 are affected, as is the @backstage/plugin-techdocs-node npm package before 1.14.6 and from 1.15.0 before 1.15.4. The package does not sufficiently validate TechDocs Markdown extension configuration (CWE-22). An authenticated user who can register or modify documentation sources can make a TechDocs build access resources outside the intended documentation boundary, potentially exposing backend-host data or internal network resources.
Written with Claude Haiku 5.5 from the sources below · 2026-11-03
Description from the CNA
Backstage is an open framework for building developer portals. Prior to 1.14.6 and 1.15.4, the @backstage/plugin-techdocs-node package did not sufficiently validate TechDocs Markdown extension configuration. An authenticated user who can register or modify documentation sources may cause a TechDocs build to access resources outside the intended documentation boundary, potentially exposing backend-host data or internal network resources. This issue is fixed in versions 1.14.6 and 1.15.4 when pymdown-extensions 10.21.3 or later is also used, normally through mkdocs-techdocs-core 1.7.0 or later.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| backstage | backstage | before 1.50.5; 1.51.0-next.0 to before 1.54.6 | 1.50.5, 1.54.6 | Patch available | CNA |
| backstage | plugin-techdocs-node | before 1.14.6; 1.15.0 to before 1.15.4 | 1.14.6, 1.15.4 | Patch available | CNA |
| — | @backstage/plugin-techdocs-node (npm) | before 1.15.4 | 1.15.4 | Patch available | GHSA-f7v3-xhm6-w245 |
- backstage Vendorbackstage Affected before 1.50.5; 1.51.0-next.0 to before 1.54.6 Fixed in 1.50.5, 1.54.6 Patch available CNA
- plugin-techdocs-node Vendorbackstage Affected before 1.14.6; 1.15.0 to before 1.15.4 Fixed in 1.14.6, 1.15.4 Patch available CNA
- @backstage/plugin-techdocs-node (npm) Vendor— Affected before 1.15.4 Fixed in 1.15.4 Patch available GHSA-f7v3-xhm6-w245
Remediation
Update Backstage to 1.50.5 or 1.54.6 and @backstage/plugin-techdocs-node to 1.14.6 or 1.15.4, and use pymdown-extensions 10.21.3 or later, normally through mkdocs-techdocs-core 1.7.0 or later. Red Hat lists Red Hat Developer Hub 1 and Self-service automation portal 2 as affected with no fix plan available.
Written with Claude Haiku 5.5 from the sources below · 2026-11-03
- Fix · CNA backstage (backstage) Fixed in 1.50.5, 1.54.6
- Fix · CNA plugin-techdocs-node (@backstage) Fixed in 1.14.6, 1.15.4
- Fix · GHSA-f7v3-xhm6-w245 @backstage/plugin-techdocs-node (npm) Fixed in 1.15.4 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Developer Hub 1 | Affected | No fix yet |
| Self-service automation portal 2 | Affected | No fix yet |
Timeline
- 2026-10-07 Threatist record created from CVE-2026-106557
- 2026-10-07 Alias added: GHSA-f7v3-xhm6-w245
- 2026-10-07 Fix available: npm/@backstage/[email protected] · GHSA-f7v3-xhm6-w245
- 2026-10-07 CVSS score added · GHSA-f7v3-xhm6-w245
- 2026-10-07 Weakness changed · GHSA-f7v3-xhm6-w245
- 2026-10-07 6 new references · GHSA-f7v3-xhm6-w245
- 2026-10-07 CISA SSVC decision points changed
- 2026-10-07 Priority changed: MEDIUM → LOW
- 2026-11-03 Affected versions changed · Red Hat
- 2026-11-03 CVSS score added · Red Hat
References
Other 6
- https://github.com/backstage/backstage/security/advisories/GHSA-f7v3-xhm6-w245
- https://github.com/backstage/backstage/commit/017ace52d9b327ededc6704cf17799c875ae0f29
- https://github.com/backstage/backstage/commit/2d9de4ca117a529de4b6ed7dfb7aa507ca7b3f91
- https://github.com/backstage/backstage/releases/tag/v1.50.5
- https://github.com/backstage/backstage/releases/tag/v1.54.6
- https://github.com/backstage/backstage
More backstage vulnerabilities
- TI-2026-33119 Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys KEVCVSS 3.1CRITICAL 9.6
- TI-2018-10499 Integer overflow in backstage kernel KEVCVSS 3.0HIGH 7.8
- TI-2024-08998 Remote Code Execution in kedro-org/kedro CVSS 3.0CRITICAL 9.8
- TI-2023-12294 Dragonfly2 vulnerable to hard coded cyptographic key CVSS 3.1CRITICAL 9.8
- TI-2021-12074 Authentication vulnerability in MOSN v.0.23.0 allows attacker to escalate privileges via… CVSS 3.1CRITICAL 9.8
- TI-2019-04061 runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows… CVSS 3.1HIGH 8.6
Sources
- CVE-2026-106557 · CVE Program
- CVE-2026-106557 · NVD
- FIRST EPSS
- GHSA-f7v3-xhm6-w245 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-106557 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences