# CVE-2026-106455: Backstage plugin-techdocs-node mkdocs config validation bypass

Source: https://junglewise.ai/threats/cve-2026-106455-backstage-is-an-open-framework-for-building-developer-portals  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-06. Updated: 2026-10-06  
License: CC BY 4.0 with a link back

CVE-2026-106455 · Severity: high · CVSS 7.7 · Published 2026-10-06

Backstage is an open-source framework for building developer portals that publish technical documentation. An authenticated attacker controlling a documentation source repository could bypass plugin validation to cause builds to access and expose data from internal network locations reachable by the build environment, potentially leaking sensitive information.

Technologies: [Backstage Plugin-Techdocs-Node](https://junglewise.ai/threats/technologies/plugin-techdocs-node), [@backstage/plugin-techdocs-node (npm)](https://junglewise.ai/threats/technologies/npm-backstage-plugin-techdocs-node). Vendors: [Backstage](https://junglewise.ai/threats/vendors/backstage), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-106455 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-106455 being exploited in the wild.

**How severe is CVE-2026-106455?** High severity, with a CVSS score of 7.7, published 6 October 2026.

**Which products and versions are affected?** Backstage Plugin-Techdocs-Node 0.11.12 through 1.14.6, 1.15.0 through 1.15.4; @backstage/plugin-techdocs-node (npm) SEMVER:introduced=0.11.12,fixed=1.14.7.

**Is there a fix for CVE-2026-106455?** Yes. @backstage/plugin-techdocs-node (npm): upgrade to 1.14.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-106455 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-106455?** Check whether you run Backstage Plugin-Techdocs-Node or @backstage/plugin-techdocs-node (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @backstage/plugin-techdocs-node (npm): upgrade to 1.14.7 or later

  ```sh
  npm install @backstage/plugin-techdocs-node@1.14.7
  ```


## Technical details

The @backstage/plugin-techdocs-node package fails to properly validate mkdocs plugin configurations in TechDocs, allowing an authenticated attacker with repository write access to inject arbitrary plugins that can retrieve data from network-accessible endpoints. The vulnerability affects versions 0.11.12 through 1.14.6 and 1.15.0 through 1.15.4; exposure depends on deployment topology and build environment protections. Modern cloud metadata services requiring special tokens or headers are noted as not directly accessible.

## Affected products

- Backstage plugin-techdocs-node 0.11.12 through 1.14.6, 1.15.0 through 1.15.4

## Identifiers

- CVE-2026-106455
- GHSA-q38j-6vcm-2f5m

## Timeline

- 2026-10-06: disclosed
- 2026-09-15: patched

## References

- [https://github.com/backstage/backstage/commit/28aa82ae2815988721dd7bbf43cd69c431dcd71b](https://github.com/backstage/backstage/commit/28aa82ae2815988721dd7bbf43cd69c431dcd71b)
- [https://github.com/backstage/backstage/commit/9f76ea445088961f68c364764cc4b7734f368fc0](https://github.com/backstage/backstage/commit/9f76ea445088961f68c364764cc4b7734f368fc0)

## Related threats

- [Backstage TechDocs remote code execution via mkdocs.yml](https://junglewise.ai/threats/cve-2026-106510-backstage-remote-code-execution-via-crafted-markdown-extensions)
- [Backstage plugin-techdocs-node code execution in MkDocs configuration](https://junglewise.ai/threats/cve-2026-106558-backstage-improper-validation-of-techdocs-mkdocs-configuration)
- [Backstage improper input validation in TechDocs Markdown extension](https://junglewise.ai/threats/cve-2026-106557-backstage-has-improper-input-validation-in-techdocs-markdown)
- [Backstage plugin-techdocs-node code execution in mkdocs configuration](https://junglewise.ai/threats/cve-2026-106509-backstage-is-an-open-framework-for-building-developer-portals)
- [Backstage TechDocs local publisher path traversal](https://junglewise.ai/threats/cve-2026-106508-backstage-is-an-open-framework-for-building-developer-portals)