CVE-2026-106556

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-106556", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-10-06T20:31:59.016Z", "datePublished": "2026-10-07T14:39:36.015Z", "dateUpdated": "2026-10-07T16:16:36.009Z"}, "containers": {"cna": {"title": "Backstage: Configuration bypass in TechDocs mkdocs.yml sanitization", "problemTypes": [{"descriptions": [{"cweId": "CWE-78", "lang": "en", "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-184", "lang": "en", "description": "CWE-184: Incomplete List of Disallowed Inputs", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/backstage/backstage/security/advisories/GHSA-g2hj-v2j6-vfvg", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/backstage/backstage/security/advisories/GHSA-g2hj-v2j6-vfvg"}, {"name": "https://github.com/backstage/backstage/commit/25125ee727a3de3418a8fa6a9e458cd5b73ecf26", "tags": ["x_refsource_MISC"], "url": "https://github.com/backstage/backstage/commit/25125ee727a3de3418a8fa6a9e458cd5b73ecf26"}, {"name": "https://github.com/backstage/backstage/commit/b6d1aea0bef99b8dfec3c8746032474867ba677a", "tags": ["x_refsource_MISC"], "url": "https://github.com/backstage/backstage/commit/b6d1aea0bef99b8dfec3c8746032474867ba677a"}, {"name": "https://github.com/backstage/backstage/releases/tag/v1.50.5", "tags": ["x_refsource_MISC"], "url": "https://github.com/backstage/backstage/releases/tag/v1.50.5"}, {"name": "https://github.com/backstage/backstage/releases/tag/v1.54.6", "tags": ["x_refsource_MISC"], "url": "https://github.com/backstage/backstage/releases/tag/v1.54.6"}], "affected": [{"vendor": "backstage", "product": "backstage", "versions": [{"version": "< 1.50.5", "status": "affected"}, {"version": ">= 1.51.0-next.0, < 1.54.6", "status": "affected"}]}, {"vendor": "@backstage", "product": "plugin-techdocs-node", "versions": [{"version": "< 1.14.6", "status": "affected"}, {"version": ">= 1.15.0, < 1.15.4", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-07T14:39:36.015Z"}, "descriptions": [{"lang": "en", "value": "Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by configuration bypass in techdocs mkdocs.yml sanitization. Insufficient validation of MkDocs configuration during TechDocs generation could allow an authenticated user who can register or modify documentation sources to execute arbitrary commands in the build environment. Impact is limited to resources accessible to the TechDocs backend or build container. This issue is fixed in versions 1.14.6 and 1.15.4."}], "source": {"advisory": "GHSA-g2hj-v2j6-vfvg", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-07T16:15:35.192583Z", "id": "CVE-2026-106556", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-07T16:16:36.009Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-106556", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-07T16:15:35.192583Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-07T16:16:23.187Z"}}], "cna": {"title": "Backstage: Configuration bypass in TechDocs mkdocs.yml sanitization", "source": {"advisory": "GHSA-g2hj-v2j6-vfvg", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "backstage", "product": "backstage", "versions": [{"status": "affected", "version": "< 1.50.5"}, {"status": "affected", "version": ">= 1.51.0-next.0, < 1.54.6"}]}, {"vendor": "@backstage", "product": "plugin-techdocs-node", "versions": [{"status": "affected", "version": "< 1.14.6"}, {"status": "affected", "version": ">= 1.15.0, < 1.15.4"}]}], "references": [{"url": "https://github.com/backstage/backstage/security/advisories/GHSA-g2hj-v2j6-vfvg", "name": "https://github.com/backstage/backstage/security/advisories/GHSA-g2hj-v2j6-vfvg", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/backstage/backstage/commit/25125ee727a3de3418a8fa6a9e458cd5b73ecf26", "name": "https://github.com/backstage/backstage/commit/25125ee727a3de3418a8fa6a9e458cd5b73ecf26", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/backstage/backstage/commit/b6d1aea0bef99b8dfec3c8746032474867ba677a", "name": "https://github.com/backstage/backstage/commit/b6d1aea0bef99b8dfec3c8746032474867ba677a", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/backstage/backstage/releases/tag/v1.50.5", "name": "https://github.com/backstage/backstage/releases/tag/v1.50.5", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/backstage/backstage/releases/tag/v1.54.6", "name": "https://github.com/backstage/backstage/releases/tag/v1.54.6", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by configuration bypass in techdocs mkdocs.yml sanitization. Insufficient validation of MkDocs configuration during TechDocs generation could allow an authenticated user who can register or modify documentation sources to execute arbitrary commands in the build environment. Impact is limited to resources accessible to the TechDocs backend or build container. This issue is fixed in versions 1.14.6 and 1.15.4."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-184", "description": "CWE-184: Incomplete List of Disallowed Inputs"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-07T14:39:36.015Z"}}}, "cveMetadata": {"cveId": "CVE-2026-106556", "state": "PUBLISHED", "dateUpdated": "2026-10-07T16:16:36.009Z", "dateReserved": "2026-10-06T20:31:59.016Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-10-07T14:39:36.015Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "backstage", "vendor": "backstage", "versions": [{"status": "affected", "version": "< 1.50.5"}, {"status": "affected", "version": ">= 1.51.0-next.0, < 1.54.6"}]}, {"product": "plugin-techdocs-node", "vendor": "@backstage", "versions": [{"status": "affected", "version": "< 1.14.6"}, {"status": "affected", "version": ">= 1.15.0, < 1.15.4"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*", "matchCriteriaId": "FEBB527C-B9CC-4ACD-ACE6-5E42C47576B7", "versionEndExcluding": "1.50.5", "vulnerable": true}, {"criteria": "cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*", "matchCriteriaId": "949CA2FA-BF88-425F-910D-3D7E817E6420", "versionEndExcluding": "1.54.6", "versionStartIncluding": "1.51.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:linuxfoundation:backstage:1.51.0:-:*:*:*:*:*:*", "matchCriteriaId": "91628A7C-3017-4ACD-A100-330BB9F983B2", "vulnerable": true}, {"criteria": "cpe:2.3:a:linuxfoundation:backstage:1.51.0:next0:*:*:*:*:*:*", "matchCriteriaId": "C5AEDDFD-39AE-4D5C-91C8-49DA83DF407F", "vulnerable": true}, {"criteria": "cpe:2.3:a:linuxfoundation:backstage:1.51.0:next1:*:*:*:*:*:*", "matchCriteriaId": "8C1DE1E3-862E-4512-A66B-9804B2451D7F", "vulnerable": true}, {"criteria": "cpe:2.3:a:linuxfoundation:backstage:1.51.0:next2:*:*:*:*:*:*", "matchCriteriaId": "C5D0AF99-42C1-4AD2-84D6-11327EFD314B", "vulnerable": true}, {"criteria": "cpe:2.3:a:linuxfoundation:backstage:1.51.0:next3:*:*:*:*:*:*", "matchCriteriaId": "3796F724-6F1F-45CA-BB1F-5F2DCCC37986", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:linuxfoundation:backstage_plugin-techdocs-node:*:*:*:*:*:*:*:*", "matchCriteriaId": "F5189301-5EC3-4F9F-952B-7993F3BFBF06", "versionEndExcluding": "1.14.6", "vulnerable": true}, {"criteria": "cpe:2.3:a:linuxfoundation:backstage_plugin-techdocs-node:*:*:*:*:*:*:*:*", "matchCriteriaId": "5CB4C5CD-5A68-42D5-AE7F-65362C0E7165", "versionEndExcluding": "1.15.4", "versionStartIncluding": "1.15.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by configuration bypass in techdocs mkdocs.yml sanitization. Insufficient validation of MkDocs configuration during TechDocs generation could allow an authenticated user who can register or modify documentation sources to execute arbitrary commands in the build environment. Impact is limited to resources accessible to the TechDocs backend or build container. This issue is fixed in versions 1.14.6 and 1.15.4."}], "id": "CVE-2026-106556", "lastModified": "2026-10-13T14:25:23.130", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.3, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-106556", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-07T16:15:35.192583Z", "version": "2.0.3"}}]}, "published": "2026-10-07T15:17:12.960", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/backstage/backstage/commit/25125ee727a3de3418a8fa6a9e458cd5b73ecf26"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/backstage/backstage/commit/b6d1aea0bef99b8dfec3c8746032474867ba677a"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Release Notes"], "url": "https://github.com/backstage/backstage/releases/tag/v1.50.5"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Release Notes"], "url": "https://github.com/backstage/backstage/releases/tag/v1.54.6"}, {"source": "security-advisories@github.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/backstage/backstage/security/advisories/GHSA-g2hj-v2j6-vfvg"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}, {"lang": "en", "value": "CWE-184"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "plugin-techdocs-node: plugin-techdocs-node: arbitrary command execution via configuration sanitization bypass", "id": "2547504", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2547504"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.7", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L", "status": "draft"}, "cwe": "CWE-78", "details": ["A flaw was found in the Backstage plugin-techdocs-node component. Insufficient validation of documentation configuration files during documentation generation allows sanitization checks to be bypassed. An authenticated user with permission to register or modify documentation sources can exploit this vulnerability to execute arbitrary commands in the build environment. This may allow an attacker to compromise the build container and access internal resources available to the documentation service."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-106556", "package_state": [{"cpe": "cpe:/a:redhat:rhdh:1", "fix_state": "Affected", "package_name": "rhdh/rhdh-hub-rhel9", "product_name": "Red Hat Developer Hub"}, {"cpe": "cpe:/a:redhat:ansible_portal:2", "fix_state": "Affected", "package_name": "ansible-automation-platform/automation-portal", "product_name": "Self-service automation portal 2"}, {"cpe": "cpe:/a:redhat:ansible_portal:2", "fix_state": "Affected", "package_name": "ansible-automation-platform/bootc-automation-portal-rhel9", "product_name": "Self-service automation portal 2"}], "public_date": "2026-10-07T14:39:36Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-106556\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-106556\nhttps://github.com/backstage/backstage/commit/25125ee727a3de3418a8fa6a9e458cd5b73ecf26\nhttps://github.com/backstage/backstage/commit/b6d1aea0bef99b8dfec3c8746032474867ba677a\nhttps://github.com/backstage/backstage/releases/tag/v1.50.5\nhttps://github.com/backstage/backstage/releases/tag/v1.54.6\nhttps://github.com/backstage/backstage/security/advisories/GHSA-g2hj-v2j6-vfvg"], "statement": "This vulnerability is rated as an Important impact because authenticated users with permissions to manage documentation entities can bypass MkDocs configuration filters to run arbitrary commands on the build system. While exploitation requires valid credentials and catalog authoring privileges, successful attacks breach intended sandbox boundaries to take control of the execution runtime. Deployments of Red Hat Developer Hub and Red Hat Ansible Automation Platform utilizing TechDocs generation are exposed if untrusted users have authorization to register or modify documentation repositories.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.50.5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.51.0-next.0,1.54.6)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "backstage", "source": "cna", "vendor": "backstage"}, "product": "backstage", "vendor": "backstage"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.14.6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.15.0,1.15.4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "plugin-techdocs-node", "source": "cna", "vendor": "@backstage"}, "product": "plugin-techdocs-node", "vendor": "backstage"}], "created": "2026-10-07T17:15:15.565309+00:00", "updated": "2026-10-09T08:15:51.806358+00:00", "vendors": ["backstage", "backstage$PRODUCT$backstage", "backstage$PRODUCT$plugin-techdocs-node"]}