CVE-2026-106557 in Backstage
Summary
by MITRE • 10/07/2026
Backstage is an open framework for building developer portals. Prior to 1.14.6 and 1.15.4, the @backstage/plugin-techdocs-node package did not sufficiently validate TechDocs Markdown extension configuration. An authenticated user who can register or modify documentation sources may cause a TechDocs build to access resources outside the intended documentation boundary, potentially exposing backend-host data or internal network resources. This issue is fixed in versions 1.14.6 and 1.15.4 when pymdown-extensions 10.21.3 or later is also used, normally through mkdocs-techdocs-core 1.7.0 or later.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/07/2026
Backstage serves as a comprehensive open framework designed for constructing developer portals, centralizing tools and documentation to streamline engineering workflows. Within this ecosystem, the TechDocs plugin plays a critical role in generating static documentation sites from Markdown sources using MkDocs. The underlying architecture relies on Python-based extensions, specifically pymdown-extensions, to process Markdown content into HTML. Prior to versions 1.14.6 and 1.15.4 of Backstage, the @backstage/plugin-techdocs-node package exhibited a significant input validation deficiency regarding how it handled configuration for these TechDocs Markdown extensions. This flaw creates an opportunity for authenticated users with permissions to register or modify documentation sources to manipulate the build process in unintended ways.
The core technical vulnerability stems from insufficient sanitization and validation of the configuration parameters passed to the pymdown-extensions library during the document generation phase. Because Backstage allows developers to define custom configurations for their documentation sites, an attacker who has gained access to a developer portal account with write privileges can inject malicious configuration directives. These directives are not adequately checked against safe boundaries before being executed by the backend service responsible for building the documentation. Consequently, when the build process is triggered, it may execute commands or load resources that fall outside the intended sandbox of the documentation directory. This lack of strict boundary enforcement allows the execution context to escape its designated scope, leading to potential unauthorized access to sensitive data hosted on the backend infrastructure or internal network resources that are not publicly accessible.
The operational impact of this vulnerability is severe for organizations relying on Backstage as a central hub for their engineering tools. An authenticated attacker can leverage this flaw to perform server-side request forgery-like actions or arbitrary file reads, effectively bypassing access controls intended to isolate documentation builds from the rest of the backend environment. This could result in the exfiltration of sensitive internal data, such as API keys, database credentials, or proprietary code snippets stored on the backend servers. Furthermore, if the underlying system permits command execution through these extensions, it could lead to remote code execution, granting the attacker full control over the server hosting the Backstage instance. This represents a critical breach in the principle of least privilege and isolation within multi-tenant developer portal environments.
From a classification perspective, this vulnerability aligns with CWE-94 Improper Control of Generation of Code or Command, as it involves the injection of malicious input that alters program flow or execution context. It also relates to CWE-200 Exposure of Sensitive Information to an Unauthorized Actor due to the potential for data leakage beyond intended boundaries. In terms of offensive security frameworks, this attack vector corresponds to ATT&CK technique T1537 Deploy Cloud Infrastructure as Code, where attackers manipulate configuration files to gain footholds, and potentially T1048 Exfiltration Over Alternative Protocol if the exfiltrated data is sent out through non-standard channels facilitated by the extension.
To mitigate this risk, organizations must immediately upgrade Backstage to version 1.14.6 or later for stable releases, or version 1.15.4 and later for newer release trains. It is crucial to note that upgrading Backstage alone may not be sufficient; the fix also requires ensuring that the underlying Python dependencies are updated. Specifically, pymdown-extensions must be at version 10.21.3 or higher. In most standard deployments, this dependency update occurs automatically through mkdocs-techdocs-core version 1.7.0 or later. Administrators should verify their lock files and package managers to confirm that these specific versions are installed across all relevant services. Additionally, implementing strict role-based access control for documentation source modification can reduce the attack surface by limiting which users have the ability to trigger builds with custom configurations. Regular auditing of plugin dependencies and staying informed about security advisories from the Backstage community is essential for maintaining a secure developer portal infrastructure.