CVE-2026-106510 Backstage: Remote code execution via crafted markdown_extensions in TechDocs mkdocs.yml

Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by remote code execution via crafted markdownextensions in techdocs mkdocs.yml. An authenticated user who can register catalog entities can provide a crafted...

@backstage/plugin-search-backend-module-techdocs (>=0.0.0-nightly-20260415031804, <=0.4.18-next.0), @backstage/plugin-techdocs-backend (>=0.0.0-nightly-2021111822616, <=2.2.3-next.1) +2 more potentially affected by CVE-2026-106510 via @backstage/plugin-techdocs-node (>=0.11.12, <=1.15.3)

@backstage/plugin-techdocs-node NPM version =0.11.12, =0.0.0-nightly-20260415031804, =0.0.0-nightly-2021111822616, =0.11.12-next.0, =0.0.0-nightly-2021111822616, =1.11.4-next.0 Source cves: CVE-2026-106510 Source advisory: MEND:CVE-2026-106510...

CVE-2026-106510

The Backstage open framework for developer portals is vulnerable to remote code execution in versions prior to 1.14.6 . The flaw exists in the @backstage/plugin-techdocs-node package, where an authenticated user capable of registering catalog entities can provide a crafted mkdocs.yml file. This i...

EUVD-2026-94369

Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by remote code execution via crafted markdownextensions in techdocs mkdocs.yml. An authenticated user who can register catalog entities can provide a crafted...

CVE-2026-106510 Backstage: Remote code execution via crafted markdown_extensions in TechDocs mkdocs.yml

Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by remote code execution via crafted markdownextensions in techdocs mkdocs.yml. An authenticated user who can register catalog entities can provide a crafted...

CVE-2026-106510 Backstage: Remote code execution via crafted markdown_extensions in TechDocs mkdocs.yml

Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by remote code execution via crafted markdownextensions in techdocs mkdocs.yml. An authenticated user who can register catalog entities can provide a crafted...

CVE-2026-106510

Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by remote code execution via crafted markdownextensions in techdocs mkdocs.yml. An authenticated user who can register catalog entities can provide a crafted...

CVE-2026-106509

A flaw was found in the Backstage plugin-techdocs-node package. When TechDocs is configured to build documentation locally or within a container, an authenticated user with write access to a registered repository can submit malicious configuration values within the MkDocs theme settings. This fla...

CVE-2026-106462

A flaw was found in Backstage. An authenticated user can cause source-control actions in the scaffolder component to fall back to broader integration credentials due to improper credential boundary enforcement. This issue allows the user to achieve privilege escalation by performing unauthorized...

CVE-2026-106457

A flaw was found in the Backstage Cloudflare Access authentication provider module. This vulnerability allows an attacker to gain unauthorized access to the Backstage application. The provider verifies a token's signature and team issuer but fails to confirm that the token was issued for the...

CVE-2026-106463

A flaw was found in Backstage's plugin-catalog-backend-module-gitlab. When GitLab organization event ingestion is enabled, improper authorization checks during user ingestion can allow unintended identities to be registered in the catalog. A remote attacker may exploit this flaw to bypass catalog...

CVE-2026-106486

A flaw was found in the Backstage Bitbucket Scaffolder backend modules. The Bitbucket pull request Scaffolder actions do not properly validate filesystem paths. An authenticated attacker who can execute an eligible template and influence an allowed repository can manipulate files outside the...

CVE-2026-106499

A flaw was found in the Backstage Scaffolder backend. In environments configured with default environment secrets, an authenticated attacker with permissions to create or modify templates can cause secret-derived values to be recorded in task logs. This issue leads to information disclosure,...

CVE-2026-106501

A flaw was found in @backstage/plugin-scaffolder-backend. An authenticated user with permission to view another user's Scaffolder task can retrieve internal task execution data, leading to sensitive information disclosure. If this execution data contains credentials for external services, an...

CVE-2026-106489

A flaw was found in the Backstage TechDocs backend plugin. An authenticated user with access to at least one documentation site can craft a request to bypass access controls when permissions and external storage are enabled. This flaw allows an attacker to view restricted documentation belonging ...

CVE-2026-106460

A flaw was found in the @backstage/plugin-auth-node package. This vulnerability allows an authenticated attacker to achieve privilege escalation by assuming another user's catalog identity and gaining their access permissions. The issue occurs because the component does not consistently enforce...

CVE-2026-106505

A flaw was found in the plugin-techdocs-node component of Backstage. This vulnerability allows an attacker with permission to commit changes to a repository utilizing TechDocs to bypass the MkDocs configuration sanitizer. By supplying a crafted configuration file, the attacker can achieve arbitra...

CVE-2026-106455

A flaw was found in the Backstage @backstage/plugin-techdocs-node package. This vulnerability allows information disclosure when an authenticated attacker with control over a TechDocs documentation repository exploits improper validation of MkDocs plugin configurations. During documentation build...

CVE-2026-106498

A flaw was found in @backstage/plugin-catalog-backend. An authenticated remote user can craft a catalog entity containing placeholder directives that reference resources outside the entity's source repository due to improper URL validation. Under certain configurations, this can lead to informati...

CVE-2026-106494

A flaw was found in the @backstage/backend-defaults package of Backstage. Improper input validation in cloud storage URL readers allows an attacker with write access to an associated cloud storage bucket to create specially crafted object names. Under certain deployment configurations, these name...