CVE-2026-106557: Backstage improper input validation in TechDocs Markdown extension

CVE-2026-106557 · Severity: high · CVSS 7.7 · Published 2026-10-07

Backstage is an open-source developer platform for building internal portals; TechDocs is its documentation-generation component. An authenticated user who can register or modify documentation sources can exploit improper input validation to access files and network resources outside the intended documentation boundary, potentially exposing sensitive backend data or internal network information depending on deployment configuration.

Technologies: Backstage Plugin-Techdocs-Node, @backstage/plugin-techdocs-node (npm). Vendors: Backstage, npm.

Quick answers

Is CVE-2026-106557 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-106557 being exploited in the wild.
How severe is CVE-2026-106557?
High severity, with a CVSS score of 7.7, published 7 October 2026.
Which products and versions are affected?
Backstage Mkdocs-Techdocs-Core < 1.7.0; Backstage Plugin-Techdocs-Node < 1.14.6, >= 1.15.0 and < 1.15.4; @backstage/plugin-techdocs-node (npm) < 1.15.4, SEMVER:introduced=0,fixed=1.15.4; Pymdown-Extensions < 10.21.3.
Is there a fix for CVE-2026-106557?
Yes. @backstage/plugin-techdocs-node (npm): upgrade to 1.15.4 or later. Until then: Generate TechDocs only from trusted repositories with reviewed MkDocs configuration. Use isolated build environments with restricted filesystem access and network egress, or prefer externally generated TechDocs with appropriately sandboxed CI pipelines. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-106557 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-106557?
Check whether you run Backstage Mkdocs-Techdocs-Core, Backstage Plugin-Techdocs-Node, @backstage/plugin-techdocs-node (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @backstage/plugin-techdocs-node (npm): upgrade to 1.15.4 or later
    npm install @backstage/plugin-techdocs-node@1.15.4

Generate TechDocs only from trusted repositories with reviewed MkDocs configuration. Use isolated build environments with restricted filesystem access and network egress, or prefer externally generated TechDocs with appropriately sandboxed CI pipelines.

Technical details

Path traversal and SSRF vulnerabilities in TechDocs Markdown extension configuration allow authenticated users to craft malicious documentation sources that bypass the restricted directory boundary. An attacker with documentation-source registration or modification privileges can access arbitrary files on the backend host or internal network resources. The vulnerability affects @backstage/plugin-techdocs-node versions before 1.14.6 and 1.15.0–1.15.3; remediation also requires pymdown-extensions 10.21.3+ (via mkdocs-techdocs-core 1.7.0+).

Affected products

  • Backstage plugin-techdocs-node < 1.14.6, >= 1.15.0 and < 1.15.4
  • Backstage mkdocs-techdocs-core < 1.7.0
  • pymdown pymdown-extensions < 10.21.3

Identifiers

  • CVE-2026-106557
  • GHSA-f7v3-xhm6-w245

Timeline

  • 2026-08-28: disclosed
  • 2026-10-07: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.