Is CVE-2026-106489 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-106489 being exploited in the wild.

How severe is CVE-2026-106489?

Medium severity, with a CVSS score of 6.5, published 6 October 2026.

Which products and versions are affected?

Backstage @Backstage/Plugin-Techdocs-Backend prior to 2.2.4; @backstage/plugin-techdocs-backend (npm) < 2.2.4, SEMVER:introduced=0,fixed=2.2.4.

Is there a fix for CVE-2026-106489?

Yes. @backstage/plugin-techdocs-backend (npm): upgrade to 2.2.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-106489 attacked?

It is attacked over the network.

Am I affected by CVE-2026-106489?

Check whether you run Backstage @Backstage/Plugin-Techdocs-Backend or @backstage/plugin-techdocs-backend (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-106489: Backstage TechDocs authorization bypass in content access

Q: Is there a fix for CVE-2026-106489?

Yes. @backstage/plugin-techdocs-backend (npm): upgrade to 2.2.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-106489 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2026-106489?

Check whether you run Backstage @Backstage/Plugin-Techdocs-Backend or @backstage/plugin-techdocs-backend (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-106489 · Severity: medium · CVSS 6.5 · Published 2026-10-06

Backstage is an open-source framework for building developer portals. The TechDocs documentation plugin had an authorization flaw that allowed an authenticated user to access documentation belonging to different projects or teams by crafting a malicious URL. This issue only affects deployments using external storage (S3, GCS) with the permission framework enabled, potentially exposing sensitive technical documentation across an organization.

Technologies: Backstage @Backstage/Plugin-Techdocs-Backend, @backstage/plugin-techdocs-backend (npm). Vendors: Backstage, npm.

Quick answers

Is CVE-2026-106489 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-106489 being exploited in the wild.
How severe is CVE-2026-106489?: Medium severity, with a CVSS score of 6.5, published 6 October 2026.
Which products and versions are affected?: Backstage @Backstage/Plugin-Techdocs-Backend prior to 2.2.4; @backstage/plugin-techdocs-backend (npm) < 2.2.4, SEMVER:introduced=0,fixed=2.2.4.
Is there a fix for CVE-2026-106489?: Yes. @backstage/plugin-techdocs-backend (npm): upgrade to 2.2.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-106489 attacked?: It is attacked over the network.
Am I affected by CVE-2026-106489?: Check whether you run Backstage @Backstage/Plugin-Techdocs-Backend or @backstage/plugin-techdocs-backend (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@backstage/plugin-techdocs-backend (npm): upgrade to 2.2.4 or later
```
npm install @backstage/plugin-techdocs-backend@2.2.4
```

Technical details

The @backstage/plugin-techdocs-backend package improperly enforced authorization when serving static TechDocs content, allowing authenticated users to bypass path-based access controls. An attacker with valid credentials could manipulate TechDocs URLs to read documentation from other entities when using external builders and storage providers with permission framework enabled. The fix validates TechDocs content paths to enforce proper authorization boundaries.

Affected products

Backstage @backstage/plugin-techdocs-backend prior to 2.2.4

Identifiers

CVE-2026-106489
GHSA-rg9r-hr7g-5gc2

Timeline

2026-10-06: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.