CVE-2026-106505: Backstage: Bypass of MkDocs configuration sanitizer in TechDocs backend

Severity: high (CVSS 8.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-06 · updated 2026-10-09
Weakness: CWE-426

Description

Backstage is an open framework for building developer portals. Prior to 1.14.6 and 1.15.4, the @backstage/plugin-techdocs-node package is affected by bypass of mkdocs configuration sanitizer in techdocs backend. Users with the ability to commit changes to a repository that uses TechDocs can circumvent the MkDocs configuration file sanitizer introduced in response to CVE-2026-25153 and execute arbitrary code on the TechDocs backend host during documentation generation. This issue is fixed in versions 1.14.6 and 1.15.4.

Affected products

backstage: before 1.50.5; from 1.51.1 before 1.54.6; 1.51.0, 1.51.0-next0, 1.51.0-next1, 1.51.0-next2, 1.51.0-next3 — fixed in 1.50.5, 1.54.6
Linuxfoundation Backstage Plugin-Techdocs-Node: before 1.14.6; from 1.15.0 before 1.15.4 — fixed in 1.14.6, 1.15.4

How to fix

Upgrade to a fixed version: backstage 1.50.5, 1.54.6; Linuxfoundation Backstage Plugin-Techdocs-Node 1.14.6, 1.15.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-106505 or the next vulnerability affects your stack