Improper Validation in Backstage Plugin Affects TechDocs Configuration
CVE-2026-106455
What is CVE-2026-106455?
The @backstage/plugin-techdocs-node package in Backstage allows an authenticated attacker with access to a TechDocs source repository to exploit improper validation in mkdocs plugin configurations. This vulnerability enables the attacker to manipulate documentation builds, potentially leading to the retrieval and publication of sensitive data from accessible network locations during the build process. Security exposure may vary depending on the deployment environment and existing endpoint protections. The issue has been addressed in versions 1.14.7 and 1.15.5 of the plugin, highlighting the importance of updating to mitigate risks.
Affected Version(s)
backstage >= 0.71.1, < 1.50.6 < 0.71.1, 1.50.6
backstage >= 1.51.0-next.0, < 1.54.8 < 1.51.0-next.0, 1.54.8
plugin-techdocs-node >= 0.11.12, < 1.14.7 < 0.11.12, 1.14.7