CVE-2026-106557
Last modified
CVE-2026-106557 is a high-severity vulnerability rated 7.7/10 on the CVSS scale. Backstage is an open framework for building developer portals. Prior to 1.14.6 and 1.15.4, the @backstage/plugin-techdocs-node package did not sufficiently validate TechDocs Markdown extension configuration. EPSS estimates a 0.30% chance of exploitation in the next 30 days.
Description
Backstage is an open framework for building developer portals. Prior to 1.14.6 and 1.15.4, the @backstage/plugin-techdocs-node package did not sufficiently validate TechDocs Markdown extension configuration. An authenticated user who can register or modify documentation sources may cause a TechDocs build to access resources outside the intended documentation boundary, potentially exposing backend-host data or internal network resources. This issue is fixed in versions 1.14.6 and 1.15.4 when pymdown-extensions 10.21.3 or later is also used, normally through mkdocs-techdocs-core 1.7.0 or later.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| backstage | backstage | < 1.50.5; >= 1.51.0-next.0, < 1.54.6 |
| @backstage | plugin-techdocs-node | < 1.14.6; >= 1.15.0, < 1.15.4 |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-106557?
How severe is CVE-2026-106557?
How do I fix CVE-2026-106557?
How Strix Helps
- One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-10655The asynchronous SNTP client in Zephyr (subsys/net/lib/sntp/…5.9
- CVE-2026-106550Mozilla's Node-convict (version 6.2.2 and later) is vulnerab…7.5
- CVE-2026-106552In sftp in OpenSSH before 10.6, a server can trigger directo…4.2
- CVE-2026-106553In sshd in OpenSSH before 10.6, credentials can incorrectly …2.2
- CVE-2026-106555In sshd in OpenSSH before 10.6, GSSAPIAuthentication authent…2.2
- CVE-2026-106556Backstage is an open framework for building developer portal…7.7
- CVE-2026-106558Backstage is an open framework for building developer portal…8.8
- CVE-2026-106559Backstage is an open framework for building developer portal…6.3
- CVE-2026-10656The MAX32xxx USB device controller driver (drivers/usb/udc/u…4.6
- CVE-2026-106560Backstage is an open framework for building developer portal…7.1
- CVE-2026-106561Backstage is an open framework for building developer portal…5
- CVE-2026-106562Backstage is an open framework for building developer portal…4.3
Are you affected by CVE-2026-106557?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST