CVE-2026-106455

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-106455
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-106455.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-106455
Aliases
Published
2026-10-06T20:06:06Z
Modified
2026-10-07T10:47:15Z
Severity
  • 7.7 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N CVSS Calculator
Summary
Backstage: Improper validation of MkDocs plugin configuration in TechDocs
Details

Backstage is an open framework for building developer portals. From 0.11.12 until 1.14.7 and 1.15.5, the @backstage/plugin-techdocs-node package is affected by improper validation of mkdocs plugin configuration in techdocs. An authenticated attacker with control over a TechDocs source repository could cause a documentation build to retrieve and publish data from network locations reachable by the build environment. Exposure depends on deployment topology, build mode, and target endpoint protections. Modern cloud metadata services that require tokens or special headers are not directly accessible through the affected behavior. This issue is fixed in @backstage/plugin-techdocs-node versions 1.14.7 and 1.15.5.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-918"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/106xxx/CVE-2026-106455.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "0.11.12"
                },
                {
                    "fixed": "1.14.7"
                },
                {
                    "introduced": "1.15.0"
                },
                {
                    "fixed": "1.15.5"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/backstage/backstage

Affected ranges

Type
GIT
Repo
https://github.com/backstage/backstage
Events
Introduced
9b46fcf52c465f3f53d53c257547ef784c11e8cd
Fixed
0f1b86f07004a0afc1958281253d5d13bb1e1cc8
Introduced
e2fdc2b61fe9046574a8fc1d99b18053018db0a8
Fixed
b565780781014c16ad5673facb953fc24ec4d969
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0.71.1"
        },
        {
            "fixed": "1.50.6"
        },
        {
            "introduced": "1.51.0-next.0"
        },
        {
            "fixed": "1.54.8"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

v1.*
v1.51.0
v1.51.0-next.0
v1.51.0-next.1
v1.51.0-next.2
v1.51.0-next.3
v1.52.0
v1.52.0-next.0
v1.52.0-next.1
v1.52.0-next.2
v1.53.0
v1.53.0-next.0
v1.53.0-next.1
v1.53.0-next.2
v1.54.0
v1.54.0-next.0
v1.54.0-next.1
v1.54.0-next.2
v1.54.0-next.3
v1.54.1
v1.54.2
v1.54.3
v1.54.4
v1.54.5
v1.54.6
v1.54.7

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-106455.json"