CVE-2026-106505: backstage — Fix

Description

Backstage is an open framework for building developer portals. Prior to 1.14.6 and 1.15.4, the @backstage/plugin-techdocs-node package is affected by bypass of mkdocs configuration sanitizer in techdocs backend. Users with the ability to commit changes to a repository that uses TechDocs can circumvent the MkDocs configuration file sanitizer introduced in response to CVE-2026-25153 and execute arbitrary code on the TechDocs backend host during documentation generation. This issue is fixed in versions 1.14.6 and 1.15.4.

Is your site exposed to CVE-2026-106505?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

7.7

HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L

EPSS — Exploit Prediction

0.0031

Probability of exploitation

0.24%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

Weakness Type (CWE)

CWE-426 CWE-426

CWE-436 CWE-436

Affected Products

Vendor	Product	Versions
linuxfoundation	backstage_plugin-techdocs-node	< 1.14.6
linuxfoundation	backstage_plugin-techdocs-node	1.15.0 — 1.15.4
linuxfoundation	backstage	< 1.50.5
linuxfoundation	backstage	1.51.1 — 1.54.6
linuxfoundation	backstage	All
linuxfoundation	backstage	All
linuxfoundation	backstage	All
linuxfoundation	backstage	All
linuxfoundation	backstage	All

References

Advisories & Patches

https://github.com/backstage/backstage/commit/a7d995f11a5d27f0efbdbe8bb6c21b06988c79c9 https://github.com/backstage/backstage/commit/ef92d3d2b76046205c580e7152956514c15640db https://github.com/backstage/backstage/releases/tag/v1.50.5 https://github.com/backstage/backstage/releases/tag/v1.54.6 https://github.com/backstage/backstage/security/advisories/GHSA-p75x-jh7p-ppcx

Frequently Asked Questions

What is CVE-2026-106505? +

Backstage is an open framework for building developer portals. Prior to 1.14.6 and 1.15.4, the @backstage/plugin-techdocs-node package is affected by bypass of mkdocs configuration sanitizer in techdocs backend. Users with the ability to commit changes to a repository that uses TechDocs can circumvent the MkDocs configuration file sanitizer introduced in response to CVE-2026-25153 and execute arbitrary code on the TechDocs backend host during documentation generation. This issue is fixed in versions 1.14.6 and 1.15.4. It has a CVSS v3.1 base score of 7.7 (HIGH).

How severe is CVE-2026-106505? +

CVE-2026-106505 has a CVSS v3.1 score of 7.7 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching. The EPSS score is 0.0031, placing it in the 0th percentile for exploitation probability.

What products are affected by CVE-2026-106505? +

CVE-2026-106505 affects products from linuxfoundation, specifically: backstage, backstage_plugin-techdocs-node. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2026-106505? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-87723

In Google fuse-archive versions prior to 1.24, an attacker who can prepend a directory to PATH or write a malicious …

CVE-2026-68492

An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to …

CVE-2026-0307

Multiple local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app allows a local user to escalate their privileges …

CVE-2026-55769

CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.28.4 and 1.29.2, CloudNativePG opened superuser …

CVE-2026-105331

Local privilege escalation in Checkmk 2.5.0 before 2.5.0p10 allows a user with access to edit the Oracle Instant Client referenced …

CVE-2026-4869

A potential privilege escalation issue was identified in InstallShield version 2025 R2 and earlier when running compressed Basic MSI setup …