Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.7
CVE-2026-106556: Backstage TechDocs lets authenticated user run commands
CVE-2026-106556 · published 28 days ago
Summary
The TechDocs component in Backstage (versions before 1.14.6) does not properly check the MkDocs configuration file, so a user who can add or edit documentation could cause arbitrary commands to run on the server that builds the docs. This could affect any data or services the build environment can reach. Upgrade Backstage to version 1.14.6 or later (or 1.15.4+) to close the issue.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| backstage | backstage | < 1.50.5 |
| @backstage | plugin-techdocs-node | < 1.14.6 |
Original advisory text
Backstage: Configuration bypass in TechDocs mkdocs.yml sanitization
Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by configuration bypass in techdocs mkdocs.yml sanitization. Insufficient validation of MkDocs configuration during TechDocs generation could allow an authenticated user who can register or modify documentation sources to execute arbitrary commands in the build environment. Impact is limited to resources accessible to the TechDocs backend or build container. This issue is fixed in versions 1.14.6 and 1.15.4.
References
- https://github.com/backstage/backstage/commit/25125ee727a3de3418a8fa6a9e458cd5b7... Patch
- https://github.com/backstage/backstage/commit/b6d1aea0bef99b8dfec3c8746032474867... Patch
- https://github.com/backstage/backstage/releases/tag/v1.54.6 URL
- https://github.com/backstage/backstage/security/advisories/GHSA-g2hj-v2j6-vfvg Vendor Advisory
- https://github.com/backstage/backstage/releases/tag/v1.50.5 URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/106xxx/CVE-2026-1065... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-106556 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-78OS Command Injection
CWE-184Incomplete List of Disallowed Inputs
Timeline
Published7 Oct 2026
Updated4 Nov 2026
First seen7 Oct 2026
Sources
CVE-2026-106556 · NVD
CVE-2026-106556 · MITRE
CVE-2026-106556 · OSV
GHSA-g2hj-v2j6-vfvg · GHSA
Track software like this
Free during beta