Is CVE-2026-106455 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-106455 being exploited in the wild.

How severe is CVE-2026-106455?

High severity, with a CVSS score of 7.7, published 6 October 2026.

Which products and versions are affected?

Backstage Plugin-Techdocs-Node 0.11.12 through 1.14.6, 1.15.0 through 1.15.4; @backstage/plugin-techdocs-node (npm) SEMVER:introduced=0.11.12,fixed=1.14.7.

Is there a fix for CVE-2026-106455?

Yes. @backstage/plugin-techdocs-node (npm): upgrade to 1.14.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-106455 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-106455?

Check whether you run Backstage Plugin-Techdocs-Node or @backstage/plugin-techdocs-node (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-106455: Backstage plugin-techdocs-node mkdocs config validation bypass

CVE-2026-106455 · Severity: high · CVSS 7.7 · Published 2026-10-06

Backstage is an open-source framework for building developer portals that publish technical documentation. An authenticated attacker controlling a documentation source repository could bypass plugin validation to cause builds to access and expose data from internal network locations reachable by the build environment, potentially leaking sensitive information.

Technologies: Backstage Plugin-Techdocs-Node, @backstage/plugin-techdocs-node (npm). Vendors: Backstage, npm.

Quick answers

Is CVE-2026-106455 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-106455 being exploited in the wild.
How severe is CVE-2026-106455?: High severity, with a CVSS score of 7.7, published 6 October 2026.
Which products and versions are affected?: Backstage Plugin-Techdocs-Node 0.11.12 through 1.14.6, 1.15.0 through 1.15.4; @backstage/plugin-techdocs-node (npm) SEMVER:introduced=0.11.12,fixed=1.14.7.
Is there a fix for CVE-2026-106455?: Yes. @backstage/plugin-techdocs-node (npm): upgrade to 1.14.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-106455 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-106455?: Check whether you run Backstage Plugin-Techdocs-Node or @backstage/plugin-techdocs-node (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@backstage/plugin-techdocs-node (npm): upgrade to 1.14.7 or later
```
npm install @backstage/plugin-techdocs-node@1.14.7
```

Technical details

The @backstage/plugin-techdocs-node package fails to properly validate mkdocs plugin configurations in TechDocs, allowing an authenticated attacker with repository write access to inject arbitrary plugins that can retrieve data from network-accessible endpoints. The vulnerability affects versions 0.11.12 through 1.14.6 and 1.15.0 through 1.15.4; exposure depends on deployment topology and build environment protections. Modern cloud metadata services requiring special tokens or headers are noted as not directly accessible.

Affected products

Backstage plugin-techdocs-node 0.11.12 through 1.14.6, 1.15.0 through 1.15.4

Identifiers

CVE-2026-106455
GHSA-q38j-6vcm-2f5m

Timeline

2026-10-06: disclosed
2026-09-15: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.