CVE-2026-106455 backstage CVE debrief

Who should care

Defenders responsible for Backstage deployments, specifically those using TechDocs and MkDocs plugins, should assess exposure based on their deployment topology, build mode, and endpoint protections. They should prioritize upgrading to patched versions of `@backstage/plugin-techdocs-node` and review plugin configurations to prevent unauthorized data retrieval.

Why it matters

CVE-2026-106455 allows authenticated attackers to cause documentation builds to retrieve and publish data from reachable network locations. Defenders should prioritize patching, review plugin configurations, and assess exposure based on deployment topology.

• Potential unauthorized data retrieval from network locations reachable by the build environment
• Need to review and update MkDocs plugin configurations to prevent exploitation
• Priority on upgrading `@backstage/plugin-techdocs-node` to patched versions
• Verification of deployment topology and build mode to assess exposure

Technical summary

CVE-2026-106455 involves improper validation of MkDocs plugin configurations in TechDocs, allowing authenticated attackers with control over a TechDocs source repository to cause documentation builds to retrieve and publish data from network locations reachable by the build environment. The vulnerability's impact depends on the deployment topology, build mode, and protections of target endpoints. Notably, modern cloud metadata services requiring tokens or special headers are not directly accessible through the affected behavior. Patches are available in `@backstage/plugin-techdocs-node` versions `1.14.7`, `1.15.5`, and `2.0.0` or later, which remove MkDocs plugins outside the built-in allowlist. Users can also configure `techdocs.generator.mkdocs.dangerouslyAllowAdditionalPlugins` to retain additional plugins after review.

Defensive priority

Defenders should prioritize upgrading `@backstage/plugin-techdocs-node` to patched versions and review MkDocs plugin configurations to prevent unauthorized data retrieval.

Recommended defensive actions

• Upgrade `@backstage/plugin-techdocs-node` to `1.14.7` or later for `1.14.x` release line
• Upgrade `@backstage/plugin-techdocs-node` to `1.15.5` or later for `1.15.x` release line
• Upgrade `@backstage/plugin-techdocs-node` to `2.0.0` or later for the current mainline
• Review and configure `techdocs.generator.mkdocs.dangerouslyAllowAdditionalPlugins` for additional plugins
• Verify deployment topology and build mode to assess exposure
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The source corpus provides details on the vulnerability and patches but does not specify exploitation or specific victims. Exposure depends on deployment topology and configurations. Defenders should verify configurations, review plugin allowlists, and assess build environment protections to understand potential impact. Additional evidence gathering may be required to confirm affected systems and validate patches.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.