{"id":"CVE-2026-106455","published":"2026-10-06T21:17:15.727","lastModified":"2026-10-09T02:16:59.963","description":"Backstage is an open framework for building developer portals. From 0.11.12 until 1.14.7 and 1.15.5, the @backstage/plugin-techdocs-node package is affected by improper validation of mkdocs plugin configuration in techdocs. An authenticated attacker with control over a TechDocs source repository could cause a documentation build to retrieve and publish data from network locations reachable by the build environment. Exposure depends on deployment topology, build mode, and target endpoint protections. Modern cloud metadata services that require tokens or special headers are not directly accessible through the affected behavior. This issue is fixed in @backstage/plugin-techdocs-node versions 1.14.7 and 1.15.5.","cvssScore":7.7,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","cwes":["CWE-918"],"vendors":[],"products":[],"references":[{"url":"https://github.com/backstage/backstage/commit/28aa82ae2815988721dd7bbf43cd69c431dcd71b","tags":[]},{"url":"https://github.com/backstage/backstage/commit/9f76ea445088961f68c364764cc4b7734f368fc0","tags":[]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.50.6","tags":[]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.54.8","tags":[]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.55.0","tags":[]},{"url":"https://github.com/backstage/backstage/security/advisories/GHSA-q38j-6vcm-2f5m","tags":[]}],"exploitRefs":[{"url":"https://github.com/backstage/backstage/commit/28aa82ae2815988721dd7bbf43cd69c431dcd71b","tags":[]},{"url":"https://github.com/backstage/backstage/commit/9f76ea445088961f68c364764cc4b7734f368fc0","tags":[]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.50.6","tags":[]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.54.8","tags":[]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.55.0","tags":[]},{"url":"https://github.com/backstage/backstage/security/advisories/GHSA-q38j-6vcm-2f5m","tags":[]}],"hasPoc":true,"ai":{"summary":"The flaw allows authenticated attackers with control over TechDocs source repositories to inject arbitrary network requests during documentation builds, potentially enabling data exfiltration from internal networks reachable by the build environment. This represents a significant information disclosure risk in developer portal deployments.","exploitability":"Moderately difficult to exploit as it requires an authenticated user with write access to a TechDocs repository, but the attack can be automated once the initial access is gained.","blast_radius":"The impact could be substantial if exploited, potentially allowing attackers to exfiltrate sensitive data from internal services that are accessible to the documentation build environment, though cloud metadata services requiring tokens remain protected.","remediation":"Upgrade to @backstage/plugin-techdocs-node version 1.14.7 or 1.15.5 immediately.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["information-disclosure","techdocs","developer-portal"],"model":"garnet-coder","analyzedAt":"2026-10-15T09:00:32.634Z"}}