CVE-2026-106558

Backstage is an open framework for building developer portals. Prior to 1.14.8, 1.15.6, and 2.0.1, the @backstage/plugin-techdocs-node package improperly validated mapping-style markdown_extensions configuration. An authenticated attacker who can register or influence an SCM-backed documentation source may bypass TechDocs sanitization and cause Python objects to be imported and instantiated in the generator runtime, leading to arbitrary code execution. Earlier fixes in versions 1.14.6 and 1.15.4 did not fully address the supported mapping representation of markdown_extensions. Impact is greatest when documentation generation runs with backend credentials, filesystem access, or internal network access. This issue is fixed in versions 1.14.8, 1.15.6, and 2.0.1.

• CWE-502

• https://github.com/backstage/backstage/commit/32723a0fe4e12ed80535fc65d5331765c55aa91b
• https://github.com/backstage/backstage/commit/944edb51c8524d3664b18f2d57ba101b1c93b709
• https://github.com/backstage/backstage/commit/f18e9abcc6051491862b15e4fc60e69f8d52310c
• https://github.com/backstage/backstage/releases/tag/v1.50.7
• https://github.com/backstage/backstage/releases/tag/v1.54.9
• https://github.com/backstage/backstage/releases/tag/v1.55.2
• https://github.com/backstage/backstage/security/advisories/GHSA-qmw3-745m-w99g

Published

Oct 7, 2026

Last Modified

Oct 7, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-106550Mozilla's Node-convict (version 6.2.2 and later) is vulnerab…7.5
• CVE-2026-106552In sftp in OpenSSH before 10.6, a server can trigger directo…4.2
• CVE-2026-106553In sshd in OpenSSH before 10.6, credentials can incorrectly …2.2
• CVE-2026-106555In sshd in OpenSSH before 10.6, GSSAPIAuthentication authent…2.2
• CVE-2026-106556Backstage is an open framework for building developer portal…7.7
• CVE-2026-106557Backstage is an open framework for building developer portal…7.7
• CVE-2026-106559Backstage is an open framework for building developer portal…6.3
• CVE-2026-10656The MAX32xxx USB device controller driver (drivers/usb/udc/u…4.6
• CVE-2026-106560Backstage is an open framework for building developer portal…7.1
• CVE-2026-106561Backstage is an open framework for building developer portal…5
• CVE-2026-106562Backstage is an open framework for building developer portal…4.3
• CVE-2026-106563Backstage is an open framework for building developer portal…5.3