CVE-2026-106455: Backstage TechDocs SSRF Vulnerability

CVE-2026-106455 Overview

CVE-2026-106455 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in the @backstage/plugin-techdocs-node package used by Backstage, an open framework for building developer portals. The flaw results from improper validation of MkDocs plugin configuration in TechDocs. An authenticated attacker with control over a TechDocs source repository can cause a documentation build to retrieve and publish data from network locations reachable by the build environment. The issue affects versions from 0.11.12 up to 1.14.7 and 1.15.5.

Critical Impact
An authenticated attacker controlling a TechDocs source repository can trigger outbound requests from the build environment, exposing internal network data based on deployment topology and endpoint protections.

Affected Products

@backstage/plugin-techdocs-node versions 0.11.12 through versions prior to 1.14.7
@backstage/plugin-techdocs-node versions prior to 1.15.5
Backstage releases prior to v1.50.6, v1.54.8, and v1.55.0

Discovery Timeline

2026-10-06 - CVE-2026-106455 published to NVD
2026-10-07 - Last updated in NVD database

Technical Details for CVE-2026-106455

Vulnerability Analysis

Backstage's TechDocs component generates documentation sites by invoking MkDocs against user-supplied source repositories. The TechDocs backend parses a mkdocs.yml configuration file from the repository and launches a documentation build. The build pipeline did not restrict which MkDocs plugins could be loaded during generation.

An attacker with write access to a TechDocs source repository can declare arbitrary MkDocs plugins in mkdocs.yml. Several community MkDocs plugins issue outbound HTTP requests or load remote resources during the build. The attacker can direct these requests to internal network endpoints reachable from the build worker and have the retrieved content published as part of the resulting documentation site.

Modern cloud metadata services that require tokens or special headers (such as IMDSv2) are not directly accessible through this behavior. Exposure depends on the deployment topology, build mode, and the protections configured on reachable internal endpoints.

Root Cause

The root cause is missing validation of the MkDocs plugins configuration key in @backstage/plugin-techdocs-node. The TechDocs generator passed through plugin declarations supplied by repository authors without constraining them to an allowlist. This allowed untrusted configuration to extend the behavior of the build process.

Attack Vector

Exploitation requires an authenticated user who can push to a TechDocs-indexed repository. The attacker commits a crafted mkdocs.yml referencing a plugin that performs network I/O, then triggers a documentation build. The build worker executes the plugin inside the Backstage build environment network, where it can reach internal services that are not exposed externally.

typescript

         */
         dangerouslyAllowAdditionalKeys?: string[];
 
+        /**
+         * List of additional MkDocs plugins to allow beyond the default set.
+         * Plugins not in this list or the default set will be removed from
+         * mkdocs.yml before documentation generation.
+         *
+         * WARNING: Some MkDocs plugins can make outbound HTTP requests or execute
+         * arbitrary code during documentation generation. Only allow plugins that
+         * have been audited for use in your environment, including the configuration
+         * options that documentation authors can supply.
+         */
+        dangerouslyAllowAdditionalPlugins?: string[];

Source: Backstage Commit 28aa82a

The patch introduces a plugin allowlist. Plugins not in the default set or the explicitly declared dangerouslyAllowAdditionalPlugins list are stripped from mkdocs.yml before the build runs.

Detection Methods for CVE-2026-106455

Indicators of Compromise

Unexpected plugins: entries in mkdocs.yml files referencing packages outside the organization's approved MkDocs plugin list.
Outbound HTTP connections from TechDocs build workers to internal IP ranges, link-local addresses, or non-documentation hosts.
Published documentation pages containing content that mirrors internal application responses, HTML error pages, or JSON payloads from internal APIs.

Detection Strategies

Audit recent commits to repositories indexed by TechDocs for additions or modifications to the plugins section of mkdocs.yml.
Correlate TechDocs build events with egress network logs to identify builds that initiated requests to internal destinations.
Review TechDocs build logs for installation of MkDocs plugins not present in the default distribution.

Monitoring Recommendations

Enable egress filtering and logging on TechDocs builder pods or workers, and alert on connections to RFC1918, loopback, or metadata service ranges.
Monitor the running version of @backstage/plugin-techdocs-node across environments and alert when it falls below 1.14.7 or 1.15.5.
Track GitHub Advisory GHSA-q38j-6vcm-2f5m for additional guidance from the Backstage maintainers.

How to Mitigate CVE-2026-106455

Immediate Actions Required

Upgrade @backstage/plugin-techdocs-node to version 1.14.7 or 1.15.5 immediately.
Upgrade Backstage to v1.50.6, v1.54.8, or v1.55.0.
Restrict write access to TechDocs-indexed repositories to trusted contributors and enforce code review on mkdocs.yml changes.
Place TechDocs build workers in a network segment that cannot reach sensitive internal services or cloud metadata endpoints.

Patch Information

The fix is delivered in @backstage/plugin-techdocs-node versions 1.14.7 and 1.15.5, included in Backstage releases v1.50.6, v1.54.8, and v1.55.0. The patched code enforces a default allowlist of MkDocs plugins and strips any plugin not explicitly permitted via the new dangerouslyAllowAdditionalPlugins configuration option. See Backstage Commit 9f76ea4 for the full change.

Workarounds

If upgrading is not immediately feasible, isolate TechDocs build runners behind egress controls that block access to internal network ranges and cloud metadata services.
Audit all mkdocs.yml files in indexed repositories and remove any plugins entries not required for documentation generation.
Disable TechDocs builds triggered from untrusted or externally-contributed repositories until the patched version is deployed.

bash

# After upgrading, explicitly declare any additional allowed plugins in app-config.yaml
techdocs:
  generator:
    mkdocs:
      dangerouslyAllowAdditionalPlugins:
        - approved-plugin-name