{"id":"CVE-2026-106557","published":"2026-10-07T17:16:50.900","lastModified":"2026-10-08T21:33:42.423","description":"Backstage is an open framework for building developer portals. Prior to 1.14.6 and 1.15.4, the @backstage/plugin-techdocs-node package did not sufficiently validate TechDocs Markdown extension configuration. An authenticated user who can register or modify documentation sources may cause a TechDocs build to access resources outside the intended documentation boundary, potentially exposing backend-host data or internal network resources. This issue is fixed in versions 1.14.6 and 1.15.4 when pymdown-extensions 10.21.3 or later is also used, normally through mkdocs-techdocs-core 1.7.0 or later.","cvssScore":7.7,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","cwes":["CWE-22","CWE-918"],"vendors":[],"products":[],"references":[{"url":"https://github.com/backstage/backstage/commit/017ace52d9b327ededc6704cf17799c875ae0f29","tags":[]},{"url":"https://github.com/backstage/backstage/commit/2d9de4ca117a529de4b6ed7dfb7aa507ca7b3f91","tags":[]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.50.5","tags":[]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.54.6","tags":[]},{"url":"https://github.com/backstage/backstage/security/advisories/GHSA-f7v3-xhm6-w245","tags":[]}],"exploitRefs":[{"url":"https://github.com/backstage/backstage/commit/017ace52d9b327ededc6704cf17799c875ae0f29","tags":[]},{"url":"https://github.com/backstage/backstage/commit/2d9de4ca117a529de4b6ed7dfb7aa507ca7b3f91","tags":[]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.50.5","tags":[]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.54.6","tags":[]},{"url":"https://github.com/backstage/backstage/security/advisories/GHSA-f7v3-xhm6-w245","tags":[]}],"hasPoc":true,"ai":{"summary":"The Backstage TechDocs plugin failed to properly validate Markdown extension configurations, allowing authenticated users to access resources outside the intended documentation boundary. This could lead to exposure of backend data or internal network resources.","exploitability":"Moderately difficult to exploit as it requires an authenticated user with permissions to register or modify documentation sources, but the attack vector is straightforward once prerequisites are met.","blast_radius":"The impact could be significant as authenticated users could potentially access sensitive backend data or internal network resources through TechDocs builds, affecting multiple services that rely on documentation hosting.","remediation":"Upgrade to Backstage versions 1.14.6 or 1.15.4, ensuring pymdown-extensions 10.21.3 or later is used through mkdocs-techdocs-core 1.7.0 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["privilege-escalation","techdocs","access-control"],"model":"garnet-coder","analyzedAt":"2026-10-15T08:59:38.201Z"}}