{"id":"EUVD-2026-94482","enisaUuid":"f383431d-97d9-3326-a4e4-861dab6406ec","description":"Backstage is an open framework for building developer portals. Prior to 1.14.6 and 1.15.4, the @backstage/plugin-techdocs-node package did not sufficiently validate TechDocs Markdown extension configuration. An authenticated user who can register or modify documentation sources may cause a TechDocs build to access resources outside the intended documentation boundary, potentially exposing backend-host data or internal network resources. This issue is fixed in versions 1.14.6 and 1.15.4 when pymdown-extensions 10.21.3 or later is also used, normally through mkdocs-techdocs-core 1.7.0 or later.","datePublished":"Oct 7, 2026, 4:22:53 PM","dateUpdated":"Oct 7, 2026, 5:47:16 PM","baseScore":7.7,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","references":"https://github.com/backstage/backstage/security/advisories/GHSA-f7v3-xhm6-w245\nhttps://github.com/backstage/backstage/commit/017ace52d9b327ededc6704cf17799c875ae0f29\nhttps://github.com/backstage/backstage/commit/2d9de4ca117a529de4b6ed7dfb7aa507ca7b3f91\nhttps://github.com/backstage/backstage/releases/tag/v1.50.5\nhttps://github.com/backstage/backstage/releases/tag/v1.54.6\n","aliases":"CVE-2026-106557\nGHSA-f7v3-xhm6-w245\n","assigner":"GitHub_M","epss":0.3,"enisaIdProduct":[{"id":"049f0ea9-d6a6-398b-85b9-feeafcad5afd","product":{"name":"backstage","vendor":{"name":"backstage"}},"product_version":"\u003c 1.50.5"},{"id":"05ae4bba-5927-33ad-9205-43a2d64b98a5","product":{"name":"plugin-techdocs-node","vendor":{"name":"@backstage"}},"product_version":"\u003c 1.14.6"},{"id":"2d646997-0214-3397-8686-0eb01680280f","product":{"name":"plugin-techdocs-node","vendor":{"name":"@backstage"}},"product_version":"1.15.0, \u003c 1.15.4"},{"id":"a5fe3327-cfc7-320d-a4f6-3c4c78e30512","product":{"name":"backstage","vendor":{"name":"backstage"}},"product_version":"1.51.0-next.0, \u003c 1.54.6"}],"enisaIdVendor":[{"id":"3ea62c07-7291-3947-aef1-20b22a40b838","vendor":{"name":"@backstage"}},{"id":"af8eded7-2c3a-373c-9b43-0ed88ed1a90e","vendor":{"name":"backstage"}}],"enisaIdVulnerability":[{"id":"5f17d556-804b-394c-b681-6557e6760426","vulnerability":{"id":"CVE-2026-106557","description":"Backstage is an open framework for building developer portals. Prior to 1.14.6 and 1.15.4, the @backstage/plugin-techdocs-node package did not sufficiently validate TechDocs Markdown extension configuration. An authenticated user who can register or modify documentation sources may cause a TechDocs build to access resources outside the intended documentation boundary, potentially exposing backend-host data or internal network resources. This issue is fixed in versions 1.14.6 and 1.15.4 when pymdown-extensions 10.21.3 or later is also used, normally through mkdocs-techdocs-core 1.7.0 or later.","datePublished":"Oct 7, 2026, 4:22:53 PM","dateUpdated":"Oct 7, 2026, 5:47:16 PM","status":"PUBLISHED","baseScore":7.7,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","references":"https://github.com/backstage/backstage/security/advisories/GHSA-f7v3-xhm6-w245\nhttps://github.com/backstage/backstage/commit/017ace52d9b327ededc6704cf17799c875ae0f29\nhttps://github.com/backstage/backstage/commit/2d9de4ca117a529de4b6ed7dfb7aa507ca7b3f91\nhttps://github.com/backstage/backstage/releases/tag/v1.50.5\nhttps://github.com/backstage/backstage/releases/tag/v1.54.6\n","enisa_id":"EUVD-2026-94482\n","assigner":"GitHub_M","epss":0.3,"dataProcessed":"Nov 1, 2026, 4:04:28 AM","vulnerabilityProduct":[{"id":"3fcc924d-336b-3d12-9cad-0de8d132ced6","product":{"name":"backstage","vendor":{"name":"backstage"}},"product_version":"1.51.0-next.0, \u003c 1.54.6"},{"id":"b6543023-c5e5-3190-ae6c-27e515439342","product":{"name":"plugin-techdocs-node","vendor":{"name":"@backstage"}},"product_version":"\u003c 1.14.6"},{"id":"c85735d8-a042-39aa-a979-89d173757b25","product":{"name":"backstage","vendor":{"name":"backstage"}},"product_version":"\u003c 1.50.5"},{"id":"dc636b59-cd76-3032-930d-b1e53a3baaf7","product":{"name":"plugin-techdocs-node","vendor":{"name":"@backstage"}},"product_version":"1.15.0, \u003c 1.15.4"}],"vulnerabilityVendor":[{"id":"54634ef7-ae55-3e29-b22a-4e5b361463c4","vendor":{"name":"backstage"}},{"id":"8582e2f7-5d54-369c-87c5-6f52ebb65617","vendor":{"name":"@backstage"}}]}},{"id":"761e8037-ee31-32e5-9066-d92547e4cb4c","vulnerability":{"id":"GHSA-f7v3-xhm6-w245","description":"Backstage has improper input validation in TechDocs Markdown extension configuration","datePublished":"Oct 7, 2026, 4:22:58 PM","dateUpdated":"Oct 7, 2026, 4:22:58 PM","baseScore":0.0,"references":"https://github.com/backstage/backstage/security/advisories/GHSA-f7v3-xhm6-w245\nhttps://github.com/backstage/backstage/commit/017ace52d9b327ededc6704cf17799c875ae0f29\nhttps://github.com/backstage/backstage/commit/2d9de4ca117a529de4b6ed7dfb7aa507ca7b3f91\nhttps://github.com/backstage/backstage\nhttps://github.com/backstage/backstage/releases/tag/v1.50.5\nhttps://github.com/backstage/backstage/releases/tag/v1.54.6\n","enisa_id":"EUVD-2026-94482\n","aliases":"CVE-2026-106557\nGHSA-f7v3-xhm6-w245\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:07:07 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}