CVE-2026-106556 Backstage: Configuration bypass in TechDocs mkdocs.yml sanitization

High 7.7 Published 7 Oct 2026 Updated 7 Oct 2026

Authenticated users can execute arbitrary commands in the build environment by bypassing MkDocs configuration sanitization in Backstage TechDocs.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-106556?

CVE-2026-106556 is a high-severity command injection vulnerability in Linuxfoundation Backstage, published on 7 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by configuration bypass in techdocs mkdocs.yml sanitization. Insufficient validation of MkDocs configuration during TechDocs generation could allow an authenticated user who can register or modify documentation sources to execute arbitrary commands in the build environment. Impact is limited to resources accessible to the TechDocs backend or build container. This issue is fixed in versions 1.14.6 and 1.15.4.

Weakness: CWE-78, CWE-184

Which versions are affected by CVE-2026-106556?

It affects 2 products.

Products include Linuxfoundation Backstage, Linuxfoundation Backstage Plugin-Techdocs-Node.

How do I fix CVE-2026-106556?

No fix has been published for CVE-2026-106556 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2026-106556 being exploited?

There is no known exploitation of CVE-2026-106556 in the wild and no public exploit code.

All Linuxfoundation Backstage vulnerabilities

Sources

Also known as GHSA-g2hj-v2j6-vfvg.