CVE-2026-106505: Backstage TechDocs RCE Vulnerability

CVE-2026-106505 Overview

CVE-2026-106505 is a sanitizer bypass vulnerability in the @backstage/plugin-techdocs-node package used by Backstage, the open framework for building developer portals. Users with commit access to a repository that uses TechDocs can bypass the MkDocs configuration file sanitizer originally introduced to address CVE-2026-25153. The bypass allows arbitrary code execution on the TechDocs backend host during documentation generation. The issue is fixed in Backstage versions 1.14.6 and 1.15.4 of the affected package. The weakness is classified under [CWE-426: Untrusted Search Path].

Critical Impact

Attackers with repository commit rights can execute arbitrary code on the TechDocs backend host, compromising documentation infrastructure and any secrets or network access available to that service.

Affected Products

• Backstage @backstage/plugin-techdocs-node prior to 1.14.6
• Backstage @backstage/plugin-techdocs-node prior to 1.15.4
• Backstage releases prior to v1.50.5 and v1.54.6

Discovery Timeline

• 2026-10-06 - CVE-2026-106505 published to NVD
• 2026-10-07 - Last updated in NVD database

Technical Details for CVE-2026-106505

Vulnerability Analysis

Backstage TechDocs generates documentation sites from Markdown source files stored in Git repositories using MkDocs. The TechDocs backend reads an mkdocs.yml configuration from the source repository and invokes MkDocs to build the static site. A prior fix for CVE-2026-25153 added a sanitizer that filtered dangerous MkDocs configuration keys before invocation. This advisory shows that the sanitizer allowed list still permitted keys that MkDocs resolves through plugin and template loading, enabling command execution during generation. Any user who can commit changes to a TechDocs-enabled repository can craft an mkdocs.yml that is accepted by the sanitizer yet triggers code execution on the backend host.

Root Cause

The allow-list in plugins/techdocs-node/src/stages/generate/helpers.ts retained the extra_templates key, which MkDocs resolves through its template loader. The sanitizer treated it as a safe passthrough, so a malicious configuration could reach the MkDocs runtime and influence code paths that load attacker-controlled resources. This matches [CWE-426] where a trusted process consumes untrusted search or load inputs.

Attack Vector

An authenticated contributor commits an mkdocs.yml containing crafted entries to a repository registered with TechDocs. When the TechDocs backend builds documentation, MkDocs processes the configuration and loads attacker-controlled templates or plugins, executing code in the context of the backend service.

// Patch excerpt: plugins/techdocs-node/src/stages/generate/helpers.ts
   'markdown_extensions',
   'extra',
   'extra_css',
-  'extra_templates',
   // Preview controls
   'use_directory_urls',
   'strict',
// Source: https://github.com/backstage/backstage/commit/a7d995f11a5d27f0efbdbe8bb6c21b06988c79c9

The fix removes extra_templates from the allowed MkDocs configuration keys so attacker-supplied template paths are stripped before the configuration reaches MkDocs.

Detection Methods for CVE-2026-106505

Indicators of Compromise

• Unexpected child processes spawned by the TechDocs backend during documentation generation, especially shells, interpreters, or outbound network tools.
• Commits that add or modify mkdocs.yml with extra_templates, custom plugins, or references to files outside the docs source tree.
• TechDocs build logs showing template or plugin loads from paths not owned by the project.

Detection Strategies

• Review Git history for mkdocs.yml changes introducing non-standard keys in repositories integrated with TechDocs.
• Monitor the TechDocs backend container or host for process executions whose parent is the MkDocs build process.
• Alert on outbound network connections initiated by the TechDocs backend during build jobs that previously had no network behavior.

Monitoring Recommendations

• Enable verbose logging on the TechDocs backend to capture MkDocs invocations and configuration snapshots per build.
• Record and retain the sanitized MkDocs configuration passed to the generator for post-incident review.
• Track the installed version of @backstage/plugin-techdocs-node across all Backstage deployments to confirm patched versions are in use.

How to Mitigate CVE-2026-106505

Immediate Actions Required

• Upgrade @backstage/plugin-techdocs-node to 1.14.6 or 1.15.4, or move to Backstage release v1.50.5 or v1.54.6.
• Audit repositories registered with TechDocs for unauthorized changes to mkdocs.yml since the vulnerability window.
• Rotate any secrets or tokens accessible to the TechDocs backend host if compromise is suspected.

Patch Information

The maintainers removed extra_templates from the sanitizer allow-list in plugins/techdocs-node/src/stages/generate/helpers.ts. Details are available in the GitHub Security Advisory GHSA-p75x-jh7p-ppcx, the Backstage Release v1.50.5 notes, the Backstage Release v1.54.6 notes, and the fix commits (a7d995f and ef92d3d).

Workarounds

• Restrict commit access on TechDocs-enabled repositories to trusted maintainers until patched versions are deployed.
• Run the TechDocs backend in an isolated, least-privilege container with no persistent credentials and no outbound network access during builds.
• Require code review on any change touching mkdocs.yml across TechDocs-integrated repositories.

# Upgrade the affected package to a fixed version
yarn up @backstage/plugin-techdocs-node@^1.15.4
# or for the 1.14.x line
yarn up @backstage/plugin-techdocs-node@^1.14.6