CVE-2026-106510: Backstage TechDocs remote code execution via mkdocs.yml

CVE-2026-106510 · Severity: high · CVSS 7.7 · Published 2026-10-07

Backstage is an open-source developer portal framework that includes TechDocs for managing technical documentation. An authenticated user with permission to register catalog entities can craft a malicious mkdocs.yml configuration file that executes arbitrary OS commands on the TechDocs build host when documentation is built, giving an attacker code execution within the build infrastructure.

Technologies: Backstage Plugin-Techdocs-Node, @backstage/plugin-techdocs-node (npm). Vendors: Backstage, npm.

Quick answers

Is CVE-2026-106510 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-106510 being exploited in the wild.
How severe is CVE-2026-106510?
High severity, with a CVSS score of 7.7, published 7 October 2026.
Which products and versions are affected?
Backstage Plugin-Techdocs-Node < 1.14.6, >= 1.15.0 and < 1.15.4; @backstage/plugin-techdocs-node (npm) < 1.15.4, SEMVER:introduced=0,fixed=1.15.4.
Is there a fix for CVE-2026-106510?
Yes. @backstage/plugin-techdocs-node (npm): upgrade to 1.15.4 or later. Until then: Switch to `techdocs.builder: external` to isolate TechDocs builds in containers, restrict catalog entity registration to trusted users with TechDocs annotations, and audit existing catalog entities for suspicious `markdown_extensions` values in mkdocs.yml files. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-106510 attacked?
It is attacked over the network.
Am I affected by CVE-2026-106510?
Check whether you run Backstage Plugin-Techdocs-Node or @backstage/plugin-techdocs-node (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @backstage/plugin-techdocs-node (npm): upgrade to 1.15.4 or later
    npm install @backstage/plugin-techdocs-node@1.15.4

Switch to `techdocs.builder: external` to isolate TechDocs builds in containers, restrict catalog entity registration to trusted users with TechDocs annotations, and audit existing catalog entities for suspicious `markdown_extensions` values in mkdocs.yml files.

Technical details

The vulnerability exists in the TechDocs plugin's handling of markdown_extensions configuration in mkdocs.yml files; unsafe reflection allows an authenticated user to specify arbitrary Python extensions that are executed during the documentation build process. The attack requires authentication and catalog entity registration privileges, but no user interaction during the build. A successful exploit grants arbitrary code execution on the TechDocs build host with the privileges of the build process.

Affected products

  • Backstage plugin-techdocs-node < 1.14.6, >= 1.15.0 and < 1.15.4

Identifiers

  • CVE-2026-106510
  • GHSA-4488-j8vj-vqqv

Timeline

  • 2026-08-28: disclosed
  • 2026-10-07: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.