CVE-2026-106510

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-106510", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-10-06T18:46:47.767Z", "datePublished": "2026-10-07T14:36:53.929Z", "dateUpdated": "2026-10-07T17:15:43.410Z"}, "containers": {"cna": {"title": "Backstage: Remote code execution via crafted markdown_extensions in TechDocs mkdocs.yml", "problemTypes": [{"descriptions": [{"cweId": "CWE-183", "lang": "en", "description": "CWE-183: Permissive List of Allowed Inputs", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-470", "lang": "en", "description": "CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/backstage/backstage/security/advisories/GHSA-4488-j8vj-vqqv", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/backstage/backstage/security/advisories/GHSA-4488-j8vj-vqqv"}, {"name": "https://github.com/backstage/backstage/commit/02cd7cdbb18b687446277b5602adaee7f1d53cbb", "tags": ["x_refsource_MISC"], "url": "https://github.com/backstage/backstage/commit/02cd7cdbb18b687446277b5602adaee7f1d53cbb"}, {"name": "https://github.com/backstage/backstage/commit/a900a9953c8f7ad3ba1906d1d257725a9996cc9d", "tags": ["x_refsource_MISC"], "url": "https://github.com/backstage/backstage/commit/a900a9953c8f7ad3ba1906d1d257725a9996cc9d"}, {"name": "https://github.com/backstage/backstage/releases/tag/v1.50.5", "tags": ["x_refsource_MISC"], "url": "https://github.com/backstage/backstage/releases/tag/v1.50.5"}, {"name": "https://github.com/backstage/backstage/releases/tag/v1.54.6", "tags": ["x_refsource_MISC"], "url": "https://github.com/backstage/backstage/releases/tag/v1.54.6"}], "affected": [{"vendor": "backstage", "product": "backstage", "versions": [{"version": "< 1.50.5", "status": "affected"}, {"version": ">= 1.51.0-next.0, < 1.54.6", "status": "affected"}]}, {"vendor": "@backstage", "product": "plugin-techdocs-node", "versions": [{"version": "< 1.14.6", "status": "affected"}, {"version": ">= 1.15.0, < 1.15.4", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-07T14:36:53.929Z"}, "descriptions": [{"lang": "en", "value": "Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by remote code execution via crafted markdown_extensions in techdocs mkdocs.yml. An authenticated user who can register catalog entities can provide a crafted mkdocs.yml causing arbitrary OS command execution on the TechDocs build host when the docs are built. This issue is fixed in versions 1.14.6 and 1.15.4."}], "source": {"advisory": "GHSA-4488-j8vj-vqqv", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-07T17:13:13.346488Z", "id": "CVE-2026-106510", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-07T17:15:43.410Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-106510", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-07T17:13:13.346488Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-07T17:14:29.371Z"}}], "cna": {"title": "Backstage: Remote code execution via crafted markdown_extensions in TechDocs mkdocs.yml", "source": {"advisory": "GHSA-4488-j8vj-vqqv", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "backstage", "product": "backstage", "versions": [{"status": "affected", "version": "< 1.50.5"}, {"status": "affected", "version": ">= 1.51.0-next.0, < 1.54.6"}]}, {"vendor": "@backstage", "product": "plugin-techdocs-node", "versions": [{"status": "affected", "version": "< 1.14.6"}, {"status": "affected", "version": ">= 1.15.0, < 1.15.4"}]}], "references": [{"url": "https://github.com/backstage/backstage/security/advisories/GHSA-4488-j8vj-vqqv", "name": "https://github.com/backstage/backstage/security/advisories/GHSA-4488-j8vj-vqqv", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/backstage/backstage/commit/02cd7cdbb18b687446277b5602adaee7f1d53cbb", "name": "https://github.com/backstage/backstage/commit/02cd7cdbb18b687446277b5602adaee7f1d53cbb", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/backstage/backstage/commit/a900a9953c8f7ad3ba1906d1d257725a9996cc9d", "name": "https://github.com/backstage/backstage/commit/a900a9953c8f7ad3ba1906d1d257725a9996cc9d", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/backstage/backstage/releases/tag/v1.50.5", "name": "https://github.com/backstage/backstage/releases/tag/v1.50.5", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/backstage/backstage/releases/tag/v1.54.6", "name": "https://github.com/backstage/backstage/releases/tag/v1.54.6", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by remote code execution via crafted markdown_extensions in techdocs mkdocs.yml. An authenticated user who can register catalog entities can provide a crafted mkdocs.yml causing arbitrary OS command execution on the TechDocs build host when the docs are built. This issue is fixed in versions 1.14.6 and 1.15.4."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-183", "description": "CWE-183: Permissive List of Allowed Inputs"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-470", "description": "CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-07T14:36:53.929Z"}}}, "cveMetadata": {"cveId": "CVE-2026-106510", "state": "PUBLISHED", "dateUpdated": "2026-10-07T17:15:43.410Z", "dateReserved": "2026-10-06T18:46:47.767Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-10-07T14:36:53.929Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "backstage", "vendor": "backstage", "versions": [{"status": "affected", "version": "< 1.50.5"}, {"status": "affected", "version": ">= 1.51.0-next.0, < 1.54.6"}]}, {"product": "plugin-techdocs-node", "vendor": "@backstage", "versions": [{"status": "affected", "version": "< 1.14.6"}, {"status": "affected", "version": ">= 1.15.0, < 1.15.4"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:linuxfoundation:backstage_plugin-techdocs-node:*:*:*:*:*:*:*:*", "matchCriteriaId": "F5189301-5EC3-4F9F-952B-7993F3BFBF06", "versionEndExcluding": "1.14.6", "vulnerable": true}, {"criteria": "cpe:2.3:a:linuxfoundation:backstage_plugin-techdocs-node:*:*:*:*:*:*:*:*", "matchCriteriaId": "5CB4C5CD-5A68-42D5-AE7F-65362C0E7165", "versionEndExcluding": "1.15.4", "versionStartIncluding": "1.15.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*", "matchCriteriaId": "FEBB527C-B9CC-4ACD-ACE6-5E42C47576B7", "versionEndExcluding": "1.50.5", "vulnerable": true}, {"criteria": "cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*", "matchCriteriaId": "949CA2FA-BF88-425F-910D-3D7E817E6420", "versionEndExcluding": "1.54.6", "versionStartIncluding": "1.51.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:linuxfoundation:backstage:1.51.0:-:*:*:*:*:*:*", "matchCriteriaId": "91628A7C-3017-4ACD-A100-330BB9F983B2", "vulnerable": true}, {"criteria": "cpe:2.3:a:linuxfoundation:backstage:1.51.0:next0:*:*:*:*:*:*", "matchCriteriaId": "C5AEDDFD-39AE-4D5C-91C8-49DA83DF407F", "vulnerable": true}, {"criteria": "cpe:2.3:a:linuxfoundation:backstage:1.51.0:next1:*:*:*:*:*:*", "matchCriteriaId": "8C1DE1E3-862E-4512-A66B-9804B2451D7F", "vulnerable": true}, {"criteria": "cpe:2.3:a:linuxfoundation:backstage:1.51.0:next2:*:*:*:*:*:*", "matchCriteriaId": "C5D0AF99-42C1-4AD2-84D6-11327EFD314B", "vulnerable": true}, {"criteria": "cpe:2.3:a:linuxfoundation:backstage:1.51.0:next3:*:*:*:*:*:*", "matchCriteriaId": "3796F724-6F1F-45CA-BB1F-5F2DCCC37986", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by remote code execution via crafted markdown_extensions in techdocs mkdocs.yml. An authenticated user who can register catalog entities can provide a crafted mkdocs.yml causing arbitrary OS command execution on the TechDocs build host when the docs are built. This issue is fixed in versions 1.14.6 and 1.15.4."}], "id": "CVE-2026-106510", "lastModified": "2026-10-13T14:25:46.490", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.3, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-106510", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-07T17:13:13.346488Z", "version": "2.0.3"}}]}, "published": "2026-10-07T15:17:12.430", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/backstage/backstage/commit/02cd7cdbb18b687446277b5602adaee7f1d53cbb"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/backstage/backstage/commit/a900a9953c8f7ad3ba1906d1d257725a9996cc9d"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Release Notes"], "url": "https://github.com/backstage/backstage/releases/tag/v1.50.5"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Release Notes"], "url": "https://github.com/backstage/backstage/releases/tag/v1.54.6"}, {"source": "security-advisories@github.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/backstage/backstage/security/advisories/GHSA-4488-j8vj-vqqv"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-183"}, {"lang": "en", "value": "CWE-470"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "plugin-techdocs-node: plugin-techdocs-node: Arbitrary code execution via crafted mkdocs configuration", "id": "2547473", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2547473"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.7", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L", "status": "draft"}, "cwe": "CWE-78", "details": ["A flaw was found in plugin-techdocs-node. An authenticated attacker with permissions to register catalog entities can achieve arbitrary code execution by submitting a crafted documentation configuration file. When the documentation is built, the malicious markdown extensions setting triggers execution of arbitrary operating system commands on the build host."], "mitigation": {"lang": "en:us", "value": "To mitigate this vulnerability, implement the following operational and configuration controls:\n1. Isolate documentation builds:\nConfigure TechDocs to delegate builds to an external pipeline rather than executing them locally on the portal host. In `app-config.yaml`, set:\n```yaml\ntechdocs:\nbuilder: 'external'\n```\nWarning: Applying configuration changes to `app-config.yaml` requires restarting or redeploying the service to take effect. Delegating to external builders requires generating documentation through external CI/CD pipelines or dedicated build runners.\n2. Restrict catalog registration:\nRestrict catalog registration privileges to authorized administrators through role-based access control (RBAC) and permission policies, preventing untrusted users from registering components with custom documentation paths.\n3. Audit catalog repositories:\nInspect existing entity repositories and their `mkdocs.yml` files for untrusted or unexpected `markdown_extensions` declarations before documentation builds are processed."}, "name": "CVE-2026-106510", "package_state": [{"cpe": "cpe:/a:redhat:rhdh:1", "fix_state": "Affected", "package_name": "rhdh/rhdh-hub-rhel9", "product_name": "Red Hat Developer Hub"}, {"cpe": "cpe:/a:redhat:ansible_portal:2", "fix_state": "Affected", "package_name": "ansible-automation-platform/automation-portal", "product_name": "Self-service automation portal 2"}, {"cpe": "cpe:/a:redhat:ansible_portal:2", "fix_state": "Affected", "package_name": "ansible-automation-platform/bootc-automation-portal-rhel9", "product_name": "Self-service automation portal 2"}], "public_date": "2026-10-07T14:36:53Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-106510\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-106510\nhttps://github.com/backstage/backstage/commit/02cd7cdbb18b687446277b5602adaee7f1d53cbb\nhttps://github.com/backstage/backstage/commit/a900a9953c8f7ad3ba1906d1d257725a9996cc9d\nhttps://github.com/backstage/backstage/releases/tag/v1.50.5\nhttps://github.com/backstage/backstage/releases/tag/v1.54.6\nhttps://github.com/backstage/backstage/security/advisories/GHSA-4488-j8vj-vqqv"], "statement": "This vulnerability is rated as Important because authenticated users permitted to register catalog entities can trigger arbitrary system commands on the backend build host. In Red Hat Developer Hub and Ansible Automation Platform environments utilizing in-tree TechDocs generation, an attacker can leverage malicious documentation configurations to compromise the host system. The impact is limited to deployments where untrusted catalog ingestion is permitted and documentation builds are not delegated to isolated external runners.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.50.5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.51.0-next.0,1.54.6)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "backstage", "source": "cna", "vendor": "backstage"}, "product": "backstage", "vendor": "backstage"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.14.6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.15.0,1.15.4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "plugin-techdocs-node", "source": "cna", "vendor": "@backstage"}, "product": "plugin-techdocs-node", "vendor": "backstage"}], "created": "2026-10-07T15:30:17.651697+00:00", "updated": "2026-10-09T08:15:53.874394+00:00", "vendors": ["backstage", "backstage$PRODUCT$backstage", "backstage$PRODUCT$plugin-techdocs-node"]}