CVE-2026-106455

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-106455", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-10-06T16:49:40.591Z", "datePublished": "2026-10-06T20:06:06.505Z", "dateUpdated": "2026-10-09T01:46:59.251Z"}, "containers": {"cna": {"title": "Backstage: Improper validation of MkDocs plugin configuration in TechDocs", "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "lang": "en", "description": "CWE-918: Server-Side Request Forgery (SSRF)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/backstage/backstage/security/advisories/GHSA-q38j-6vcm-2f5m", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/backstage/backstage/security/advisories/GHSA-q38j-6vcm-2f5m"}, {"name": "https://github.com/backstage/backstage/commit/28aa82ae2815988721dd7bbf43cd69c431dcd71b", "tags": ["x_refsource_MISC"], "url": "https://github.com/backstage/backstage/commit/28aa82ae2815988721dd7bbf43cd69c431dcd71b"}, {"name": "https://github.com/backstage/backstage/commit/9f76ea445088961f68c364764cc4b7734f368fc0", "tags": ["x_refsource_MISC"], "url": "https://github.com/backstage/backstage/commit/9f76ea445088961f68c364764cc4b7734f368fc0"}, {"name": "https://github.com/backstage/backstage/releases/tag/v1.50.6", "tags": ["x_refsource_MISC"], "url": "https://github.com/backstage/backstage/releases/tag/v1.50.6"}, {"name": "https://github.com/backstage/backstage/releases/tag/v1.54.8", "tags": ["x_refsource_MISC"], "url": "https://github.com/backstage/backstage/releases/tag/v1.54.8"}, {"name": "https://github.com/backstage/backstage/releases/tag/v1.55.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/backstage/backstage/releases/tag/v1.55.0"}], "affected": [{"vendor": "backstage", "product": "backstage", "versions": [{"version": ">= 0.71.1, < 1.50.6", "status": "affected"}, {"version": ">= 1.51.0-next.0, < 1.54.8", "status": "affected"}]}, {"vendor": "@backstage", "product": "plugin-techdocs-node", "versions": [{"version": ">= 0.11.12, < 1.14.7", "status": "affected"}, {"version": ">= 1.15.0, < 1.15.5", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-06T20:06:06.505Z"}, "descriptions": [{"lang": "en", "value": "Backstage is an open framework for building developer portals. From 0.11.12 until 1.14.7 and 1.15.5, the @backstage/plugin-techdocs-node package is affected by improper validation of mkdocs plugin configuration in techdocs. An authenticated attacker with control over a TechDocs source repository could cause a documentation build to retrieve and publish data from network locations reachable by the build environment. Exposure depends on deployment topology, build mode, and target endpoint protections. Modern cloud metadata services that require tokens or special headers are not directly accessible through the affected behavior. This issue is fixed in @backstage/plugin-techdocs-node versions 1.14.7 and 1.15.5."}], "source": {"advisory": "GHSA-q38j-6vcm-2f5m", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-09T01:46:47.854131Z", "id": "CVE-2026-106455", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-09T01:46:59.251Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-106455", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-09T01:46:47.854131Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-09T01:46:53.067Z"}}], "cna": {"title": "Backstage: Improper validation of MkDocs plugin configuration in TechDocs", "source": {"advisory": "GHSA-q38j-6vcm-2f5m", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "backstage", "product": "backstage", "versions": [{"status": "affected", "version": ">= 0.71.1, < 1.50.6"}, {"status": "affected", "version": ">= 1.51.0-next.0, < 1.54.8"}]}, {"vendor": "@backstage", "product": "plugin-techdocs-node", "versions": [{"status": "affected", "version": ">= 0.11.12, < 1.14.7"}, {"status": "affected", "version": ">= 1.15.0, < 1.15.5"}]}], "references": [{"url": "https://github.com/backstage/backstage/security/advisories/GHSA-q38j-6vcm-2f5m", "name": "https://github.com/backstage/backstage/security/advisories/GHSA-q38j-6vcm-2f5m", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/backstage/backstage/commit/28aa82ae2815988721dd7bbf43cd69c431dcd71b", "name": "https://github.com/backstage/backstage/commit/28aa82ae2815988721dd7bbf43cd69c431dcd71b", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/backstage/backstage/commit/9f76ea445088961f68c364764cc4b7734f368fc0", "name": "https://github.com/backstage/backstage/commit/9f76ea445088961f68c364764cc4b7734f368fc0", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/backstage/backstage/releases/tag/v1.50.6", "name": "https://github.com/backstage/backstage/releases/tag/v1.50.6", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/backstage/backstage/releases/tag/v1.54.8", "name": "https://github.com/backstage/backstage/releases/tag/v1.54.8", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/backstage/backstage/releases/tag/v1.55.0", "name": "https://github.com/backstage/backstage/releases/tag/v1.55.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Backstage is an open framework for building developer portals. From 0.11.12 until 1.14.7 and 1.15.5, the @backstage/plugin-techdocs-node package is affected by improper validation of mkdocs plugin configuration in techdocs. An authenticated attacker with control over a TechDocs source repository could cause a documentation build to retrieve and publish data from network locations reachable by the build environment. Exposure depends on deployment topology, build mode, and target endpoint protections. Modern cloud metadata services that require tokens or special headers are not directly accessible through the affected behavior. This issue is fixed in @backstage/plugin-techdocs-node versions 1.14.7 and 1.15.5."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918: Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-06T20:06:06.505Z"}}}, "cveMetadata": {"cveId": "CVE-2026-106455", "state": "PUBLISHED", "dateUpdated": "2026-10-09T01:46:59.251Z", "dateReserved": "2026-10-06T16:49:40.591Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-10-06T20:06:06.505Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "backstage", "vendor": "backstage", "versions": [{"status": "affected", "version": ">= 0.71.1, < 1.50.6"}, {"status": "affected", "version": ">= 1.51.0-next.0, < 1.54.8"}]}, {"product": "plugin-techdocs-node", "vendor": "@backstage", "versions": [{"status": "affected", "version": ">= 0.11.12, < 1.14.7"}, {"status": "affected", "version": ">= 1.15.0, < 1.15.5"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:linuxfoundation:backstage_plugin-techdocs-node:*:*:*:*:*:*:*:*", "matchCriteriaId": "52DB8917-0644-4484-A243-9A2CFCE3D2DD", "versionEndExcluding": "1.14.7", "versionStartIncluding": "0.11.12", "vulnerable": true}, {"criteria": "cpe:2.3:a:linuxfoundation:backstage_plugin-techdocs-node:*:*:*:*:*:*:*:*", "matchCriteriaId": "837D9752-08C5-431B-B967-BA9826510E0D", "versionEndExcluding": "1.15.5", "versionStartIncluding": "1.15.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*", "matchCriteriaId": "242C6C2C-8D2A-43DF-8F22-B2EBB132CEF4", "versionEndExcluding": "1.50.6", "versionStartIncluding": "0.71.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*", "matchCriteriaId": "38754AA7-90F4-4854-BB3C-A7E4D0CB3B34", "versionEndExcluding": "1.54.8", "versionStartIncluding": "1.51.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:linuxfoundation:backstage:1.51.0:-:*:*:*:*:*:*", "matchCriteriaId": "91628A7C-3017-4ACD-A100-330BB9F983B2", "vulnerable": true}, {"criteria": "cpe:2.3:a:linuxfoundation:backstage:1.51.0:next0:*:*:*:*:*:*", "matchCriteriaId": "C5AEDDFD-39AE-4D5C-91C8-49DA83DF407F", "vulnerable": true}, {"criteria": "cpe:2.3:a:linuxfoundation:backstage:1.51.0:next1:*:*:*:*:*:*", "matchCriteriaId": "8C1DE1E3-862E-4512-A66B-9804B2451D7F", "vulnerable": true}, {"criteria": "cpe:2.3:a:linuxfoundation:backstage:1.51.0:next2:*:*:*:*:*:*", "matchCriteriaId": "C5D0AF99-42C1-4AD2-84D6-11327EFD314B", "vulnerable": true}, {"criteria": "cpe:2.3:a:linuxfoundation:backstage:1.51.0:next3:*:*:*:*:*:*", "matchCriteriaId": "3796F724-6F1F-45CA-BB1F-5F2DCCC37986", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Backstage is an open framework for building developer portals. From 0.11.12 until 1.14.7 and 1.15.5, the @backstage/plugin-techdocs-node package is affected by improper validation of mkdocs plugin configuration in techdocs. An authenticated attacker with control over a TechDocs source repository could cause a documentation build to retrieve and publish data from network locations reachable by the build environment. Exposure depends on deployment topology, build mode, and target endpoint protections. Modern cloud metadata services that require tokens or special headers are not directly accessible through the affected behavior. This issue is fixed in @backstage/plugin-techdocs-node versions 1.14.7 and 1.15.5."}], "id": "CVE-2026-106455", "lastModified": "2026-10-13T15:27:12.653", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 4.0, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-106455", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-09T01:46:47.854131Z", "version": "2.0.3"}}]}, "published": "2026-10-06T21:17:15.727", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/backstage/backstage/commit/28aa82ae2815988721dd7bbf43cd69c431dcd71b"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/backstage/backstage/commit/9f76ea445088961f68c364764cc4b7734f368fc0"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Release Notes"], "url": "https://github.com/backstage/backstage/releases/tag/v1.50.6"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Release Notes"], "url": "https://github.com/backstage/backstage/releases/tag/v1.54.8"}, {"source": "security-advisories@github.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://github.com/backstage/backstage/releases/tag/v1.55.0"}, {"source": "security-advisories@github.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/backstage/backstage/security/advisories/GHSA-q38j-6vcm-2f5m"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "@backstage/plugin-techdocs-node: @backstage/plugin-techdocs-node: Information disclosure via improper MkDocs configuration validation", "id": "2547148", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2547148"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-918", "details": ["A flaw was found in the Backstage @backstage/plugin-techdocs-node package. This vulnerability allows information disclosure when an authenticated attacker with control over a TechDocs documentation repository exploits improper validation of MkDocs plugin configurations. During documentation builds, the attacker can cause the build process to retrieve and publish sensitive data from network locations reachable by the build environment."], "name": "CVE-2026-106455", "package_state": [{"cpe": "cpe:/a:redhat:rhdh:1", "fix_state": "Affected", "package_name": "rhdh/rhdh-hub-rhel9", "product_name": "Red Hat Developer Hub"}, {"cpe": "cpe:/a:redhat:ansible_portal:2", "fix_state": "Affected", "package_name": "ansible-automation-platform/automation-portal", "product_name": "Self-service automation portal 2"}, {"cpe": "cpe:/a:redhat:ansible_portal:2", "fix_state": "Affected", "package_name": "ansible-automation-platform/bootc-automation-portal-rhel9", "product_name": "Self-service automation portal 2"}], "public_date": "2026-10-06T20:06:06Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-106455\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-106455\nhttps://github.com/backstage/backstage/commit/28aa82ae2815988721dd7bbf43cd69c431dcd71b\nhttps://github.com/backstage/backstage/commit/9f76ea445088961f68c364764cc4b7734f368fc0\nhttps://github.com/backstage/backstage/releases/tag/v1.50.6\nhttps://github.com/backstage/backstage/releases/tag/v1.54.8\nhttps://github.com/backstage/backstage/releases/tag/v1.55.0\nhttps://github.com/backstage/backstage/security/advisories/GHSA-q38j-6vcm-2f5m"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.71.1,1.50.6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.51.0-next.0,1.54.8)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "backstage", "source": "cna", "vendor": "backstage"}, "product": "backstage", "vendor": "backstage"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.11.12,1.14.7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.15.0,1.15.5)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "plugin-techdocs-node", "source": "cna", "vendor": "@backstage"}, "product": "plugin-techdocs-node", "vendor": "backstage"}], "created": "2026-10-07T00:30:08.436162+00:00", "updated": "2026-10-09T08:31:53.396536+00:00", "vendors": ["backstage", "backstage$PRODUCT$backstage", "backstage$PRODUCT$plugin-techdocs-node"]}