CVE-2026-106556Published
Backstage: Configuration bypass in TechDocs mkdocs.yml sanitization
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-106556 · Microsoft / collected KEV context
cve-program · CVE-2026-106556
- https://github.com/backstage/backstage/security/advisories/GHSA-g2hj-v2j6-vfvg
- https://github.com/backstage/backstage/commit/25125ee727a3de3418a8fa6a9e458cd5b73ecf26
- https://github.com/backstage/backstage/commit/b6d1aea0bef99b8dfec3c8746032474867ba677a
- https://github.com/backstage/backstage/releases/tag/v1.50.5
- https://github.com/backstage/backstage/releases/tag/v1.54.6
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.