Insufficient Validation in Backstage TechDocs Plugin by Spotify
CVE-2026-106557
What is CVE-2026-106557?
The Backstage TechDocs plugin, used for creating developer portals, had a flaw prior to versions 1.14.6 and 1.15.4. It failed to validate Markdown extension configurations adequately. This vulnerability could allow an authenticated user, capable of registering or modifying documentation sources, to trigger a TechDocs build that accesses resources beyond the intended documentation scope. As a result, sensitive backend data or internal network resources could potentially be exposed. This issue is addressed in versions 1.14.6 and 1.15.4, provided that pymdown-extensions version 10.21.3 or later is utilized, typically through mkdocs-techdocs-core version 1.7.0 or later.
Affected Version(s)
backstage < 1.50.5 < 1.50.5
backstage >= 1.51.0-next.0, < 1.54.6 < 1.51.0-next.0, 1.54.6
plugin-techdocs-node < 1.14.6 < 1.14.6