Junglewise Threat Intelligence

CVE-2026-29186: Backstage TechDocs arbitrary code execution via MkDocs configuration bypass

CVE-2026-29186 · Severity: high · CVSS 7.7 · Published 2026-03-07

Technologies: Red Hat Developer Hub. Vendors: Backstage, Linuxfoundation, Red Hat.

Executive brief

Backstage, a popular framework for building developer portals, contains a security flaw in its TechDocs component. An attacker with the ability to modify documentation configuration files can bypass security filters to execute malicious code on the server. This could lead to a complete system takeover, unauthorized access to sensitive internal data, or disruption of the developer portal services.

Technical details

A configuration bypass vulnerability exists in the @backstage/plugin-techdocs-node package of Backstage. The plugin uses an allowlist to filter dangerous MkDocs configuration keys during the documentation build process; however, a gap in this allowlist allows attackers to inject malicious keys into the mkdocs.yml file. Specifically, this can be used to trigger MkDocs 'hooks' (introduced in MkDocs 1.4.0) to execute arbitrary Python code. The attack requires the ability to modify the mkdocs.yml file in a repository processed by TechDocs. The vulnerability is patched in version 1.14.3. As a workaround, users can run TechDocs in Docker mode for better isolation or restrict access to documentation configuration files.

Affected products

  • Backstage Backstage < 1.14.3
  • Backstage @backstage/plugin-techdocs-node < 1.14.3
  • Red Hat Red Hat Developer Hub 1.8 1.8.6
  • Red Hat Red Hat Developer Hub 1.9 1.9.4

Timeline

  • 2026-03-04: advisory: GitHub Security Advisory published by maintainers
  • 2026-03-07: disclosed: NVD publication date
  • 2026-04-22: patched: Red Hat released fix for Developer Hub 1.8.6
  • 2026-05-05: patched: Red Hat released fix for Developer Hub 1.9.4

References

Related threats