CVE-2026-106490: Backstage TechDocs Information Disclosure

CVE-2026-106490 Overview

CVE-2026-106490 is an improper input validation vulnerability in the @backstage/plugin-techdocs-backend package of Backstage, an open framework for building developer portals. The flaw affects TechDocs static content requests when the Azure Blob Storage provider is configured. An authenticated Backstage user can read restricted TechDocs content when entity-level permissions are enabled. Deployments that disable the default backend authentication policy face broader exposure. The issue is fixed in version 2.2.4 of the plugin.

Critical Impact
Authenticated users can bypass entity-level permissions to read restricted TechDocs content hosted on Azure Blob Storage, exposing documentation intended to be access-controlled.

Affected Products

Backstage @backstage/plugin-techdocs-backend prior to version 2.2.4
Backstage deployments using the Azure Blob Storage provider for TechDocs
Backstage deployments with the default backend authentication policy disabled (broader exposure)

Discovery Timeline

2026-10-06 - CVE-2026-106490 published to NVD
2026-10-07 - Last updated in NVD database

Technical Details for CVE-2026-106490

Vulnerability Analysis

The vulnerability resides in the TechDocs backend router, which serves static documentation content from configured storage providers. When the Azure Blob Storage provider is used, the request path handling logic does not sufficiently restrict traversal outside the requested entity's documentation scope. An authenticated user with permission to read one entity's TechDocs can craft requests that resolve to blob paths belonging to another entity, bypassing entity-level permission enforcement. The classification is Path Traversal [CWE-22].

Root Cause

The pre-patch implementation relied on a helper function isPathWithinEntity that normalized the decoded request path and rejected only paths equal to .. or starting with ../. This check failed to account for all encodings and path constructions that could resolve outside the entity boundary when combined with Azure Blob Storage's object naming semantics. The fix removes this insufficient helper and introduces stricter path handling in plugins/techdocs-backend/src/service/router.ts.

Attack Vector

An authenticated attacker sends a crafted HTTP request to the TechDocs static content endpoint. The request path manipulates the entity segment to resolve to a different entity's blob prefix in Azure storage. Because entity-level permission checks are tied to the parsed entity, the authorization decision is made against the attacker's claimed entity while the storage lookup returns another entity's content. No user interaction is required, and exploitation does not alter or disrupt the system.

typescript

// Patch from plugins/techdocs-backend/src/service/router.ts
 import { durationToMilliseconds } from '@backstage/types';
 import path from 'node:path';
 
-const isPathWithinEntity = (requestPath: string): boolean => {
-  const relativePath = path.posix.normalize(
-    decodeURI(requestPath).replace(/^\/+/, ''),
-  );
-  return relativePath !== '..' && !relativePath.startsWith('../');
-};
-
 /**
  * Required dependencies for running TechDocs in the "out-of-the-box"
  * deployment configuration (prepare/generate/publish all in the Backend).

Source: Backstage commit 40ecc4c. The patch removes the insufficient path validation helper and replaces it with stricter content path handling.

Detection Methods for CVE-2026-106490

Indicators of Compromise

TechDocs backend access logs containing requests with encoded traversal sequences such as %2e%2e%2f or repeated ../ segments in the entity path portion of the URL.
Successful TechDocs static content responses where the requested entity in the URL does not match the entity the authenticated user has permissions to access.
Anomalous volumes of 200 OK responses from /api/techdocs/static/docs/* endpoints originating from a single authenticated session.

Detection Strategies

Review Backstage backend access logs for TechDocs static content requests referencing entities outside the normal browsing pattern of each user identity.
Correlate TechDocs request paths with the authenticated user's permission scope to identify authorization-to-resource mismatches.
Inspect Azure Blob Storage access logs for TechDocs container reads that do not align with corresponding Backstage permission events.

Monitoring Recommendations

Enable verbose request logging on the @backstage/plugin-techdocs-backend router and forward logs to a centralized analytics platform.
Alert on repeated TechDocs requests from the same session that enumerate multiple distinct entity namespaces within a short time window.
Monitor Azure Storage diagnostic logs for unusual blob read patterns on the TechDocs container.

How to Mitigate CVE-2026-106490

Immediate Actions Required

Upgrade @backstage/plugin-techdocs-backend to version 2.2.4 or later across all Backstage backend deployments.
Audit Backstage deployments that have disabled the default backend authentication policy and re-enable it where feasible.
Review TechDocs entity-level permission configurations and verify restricted content is not accessible to unauthorized users.

Patch Information

The fix is included in @backstage/plugin-techdocs-backend version 2.2.4 and is shipped as part of the Backstage v1.54.6 release. Technical details are available in the GHSA-7mfx-xg57-53c9 security advisory and the upstream commit 40ecc4c.

Workarounds

If immediate upgrade is not possible, restrict access to the Backstage instance to a trusted set of authenticated users through network-level controls.
Consider temporarily switching the TechDocs publisher away from Azure Blob Storage to a provider not affected by this specific validation flaw, if operationally feasible.
Re-enable the default backend authentication policy if it was previously disabled to reduce exposure.

bash

# Upgrade the affected package to the fixed version
yarn workspace backend add @backstage/plugin-techdocs-backend@^2.2.4

# Verify the installed version
yarn workspace backend why @backstage/plugin-techdocs-backend