CVE-2026-106455: backstage >= 0.71.1, < 1.50.6, >= 1.51.0-next.0, < 1.54.8; +1 more affected products

Affected technology

backstage · >= 0.71.1, < 1.50.6, >= 1.51.0-next.0, < 1.54.8
backstage

plugin-techdocs-node · >= 0.11.12, < 1.14.7, >= 1.15.0, < 1.15.5
@backstage

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

An authenticated attacker with control over a TechDocs source repository could cause a documentation build to retrieve and publish data from network locations reachable by the build environment. Vendor/CNA’s CVSS 3.1 assessment (base score 7.7/10) rates confidentiality impact as high; integrity and availability impact as none.