CVE-2026-106556

{
  "etk_id": "ETK-2026-946",
  "cve_id": "CVE-2026-106556",
  "display_id": "CVE-2026-106556",
  "ghsa_id": "GHSA-g2hj-v2j6-vfvg",
  "euvd_id": "EUVD-2026-94370",
  "status": "published",
  "anchor_state": "anchored",
  "title": "TechDocs MkDocs configuration validation bypass in Backstage",
  "summary": "Backstage TechDocs processing can insufficiently validate MkDocs configuration in documentation sources. An authenticated user permitted to register or modify those sources may run commands in the TechDocs build environment, with access constrained to resources available to that backend or container.",
  "mitigation": "Upgrade affected Backstage deployments to 1.50.5 or 1.54.6, and update plugin-techdocs-node to 1.14.6 or 1.15.4. Until upgraded, restrict who can register or modify TechDocs documentation sources.",
  "vendor": "backstage",
  "product": "backstage",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "< 1.14.6"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "1.14.6"
      ],
      "package_name": "@backstage/plugin-techdocs-node",
      "purl": "pkg:npm/@backstage/plugin-techdocs-node"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 1.15.0, < 1.15.4"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "1.15.4"
      ],
      "package_name": "@backstage/plugin-techdocs-node",
      "purl": "pkg:npm/@backstage/plugin-techdocs-node"
    }
  ],
  "cwes": [
    78
  ],
  "cvss_score": 7.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L",
  "epss_score": 0.0026,
  "epss_percentile": 0.1629,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 15.451913616666667,
  "t0_at": "2026-10-07T14:39:36.015000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-07T14:39:36.015000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-07T14:39:36.015000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-106556"
    }
  }
}