# CVE-2026-29186: Backstage TechDocs arbitrary code execution via MkDocs configuration bypass

Source: https://junglewise.ai/threats/cve-2026-29186-backstage-techdocs-arbitrary-code-execution-via-mkdocs  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-07. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-29186 · Severity: high · CVSS 7.7 · Published 2026-03-07

Backstage, a popular framework for building developer portals, contains a security flaw in its TechDocs component. An attacker with the ability to modify documentation configuration files can bypass security filters to execute malicious code on the server. This could lead to a complete system takeover, unauthorized access to sensitive internal data, or disruption of the developer portal services.

Technologies: [Backstage Plugin-Techdocs-Node](https://junglewise.ai/threats/technologies/plugin-techdocs-node), [@backstage/plugin-techdocs-node (npm)](https://junglewise.ai/threats/technologies/npm-backstage-plugin-techdocs-node), [Red Hat Developer Hub](https://junglewise.ai/threats/technologies/developer-hub). Vendors: [Backstage](https://junglewise.ai/threats/vendors/backstage), [Linuxfoundation](https://junglewise.ai/threats/vendors/linuxfoundation), [npm](https://junglewise.ai/threats/vendors/npm), [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-29186 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-29186 being exploited in the wild.

**How severe is CVE-2026-29186?** High severity, with a CVSS score of 7.7, published 7 March 2026.

**Which products and versions are affected?** Backstage Plugin-Techdocs-Node < 1.14.3; @backstage/plugin-techdocs-node (npm) SEMVER:introduced=0,fixed=1.14.3; Red Hat Developer Hub 1.8.6.

**Is there a fix for CVE-2026-29186?** Yes. @backstage/plugin-techdocs-node (npm): upgrade to 1.14.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-29186 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-29186?** Check whether you run Backstage Plugin-Techdocs-Node, Linuxfoundation Backstage Plugin-Techdocs-Node, @backstage/plugin-techdocs-node (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @backstage/plugin-techdocs-node (npm): upgrade to 1.14.3 or later

  ```sh
  npm install @backstage/plugin-techdocs-node@1.14.3
  ```


## Technical details

A configuration bypass vulnerability exists in the @backstage/plugin-techdocs-node package of Backstage. The plugin uses an allowlist to filter dangerous MkDocs configuration keys during the documentation build process; however, a gap in this allowlist allows attackers to inject malicious keys into the mkdocs.yml file. Specifically, this can be used to trigger MkDocs 'hooks' (introduced in MkDocs 1.4.0) to execute arbitrary Python code. The attack requires the ability to modify the mkdocs.yml file in a repository processed by TechDocs. The vulnerability is patched in version 1.14.3. As a workaround, users can run TechDocs in Docker mode for better isolation or restrict access to documentation configuration files.

## Affected products

- Backstage Backstage < 1.14.3
- Backstage @backstage/plugin-techdocs-node < 1.14.3
- Red Hat Red Hat Developer Hub 1.8 1.8.6
- Red Hat Red Hat Developer Hub 1.9 1.9.4

## Identifiers

- CVE-2026-29186
- GHSA-928r-fm4v-mvrw

## Timeline

- 2026-03-04: advisory: GitHub Security Advisory published by maintainers
- 2026-03-07: disclosed: NVD publication date
- 2026-04-22: patched: Red Hat released fix for Developer Hub 1.8.6
- 2026-05-05: patched: Red Hat released fix for Developer Hub 1.9.4

## References

- [https://github.com/backstage/backstage/security/advisories/GHSA-928r-fm4v-mvrw](https://github.com/backstage/backstage/security/advisories/GHSA-928r-fm4v-mvrw)
- [https://access.redhat.com/errata/RHSA-2026:13826](https://access.redhat.com/errata/RHSA-2026:13826)
- [https://access.redhat.com/errata/RHSA-2026:9742](https://access.redhat.com/errata/RHSA-2026:9742)
- [https://access.redhat.com/security/cve/CVE-2026-29186](https://access.redhat.com/security/cve/CVE-2026-29186)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2445480](https://bugzilla.redhat.com/show_bug.cgi?id=2445480)
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-29186.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-29186.json)

## Related threats

- [Backstage TechDocs remote code execution via mkdocs.yml](https://junglewise.ai/threats/cve-2026-106510-backstage-remote-code-execution-via-crafted-markdown-extensions)
- [Backstage plugin-techdocs-node code execution in MkDocs configuration](https://junglewise.ai/threats/cve-2026-106558-backstage-improper-validation-of-techdocs-mkdocs-configuration)
- [Backstage improper input validation in TechDocs Markdown extension](https://junglewise.ai/threats/cve-2026-106557-backstage-has-improper-input-validation-in-techdocs-markdown)
- [Backstage plugin-techdocs-node code execution in mkdocs configuration](https://junglewise.ai/threats/cve-2026-106509-backstage-is-an-open-framework-for-building-developer-portals)
- [Backstage TechDocs local publisher path traversal](https://junglewise.ai/threats/cve-2026-106508-backstage-is-an-open-framework-for-building-developer-portals)