Plugin techdocs node: Backstage: Improper validation of MkDocs plugin configuration in TechDocs (CVE-2026-106455)

CVE-2026-106455 is a vulnerability in the Backstage @backstage/plugin-techdocs-node component where improper validation of MkDocs plugin configuration allows an authenticated attacker controlling a TechDocs source repository to cause documentation builds to fetch and publish data from network locations reachable by the build environment. The vulnerability's impact varies based on deployment and network protections. The fix involves upgrading to patched versions (1.14.7+, 1.15.5+, or 2.0.0+) which enforce a built-in allowlist of MkDocs plugins, removing unauthorized plugins. Configuration options exist to allow additional plugins after review.

An attacker with authenticated access to a TechDocs source repository can manipulate documentation builds to access and publish data from internal or network locations accessible to the build environment. This could lead to unauthorized data exposure. The vulnerability does not directly expose modern cloud metadata services that require tokens or special headers. The severity is high with a CVSS score of 7.7, indicating significant confidentiality impact but no integrity or availability impact.

Upgrade @backstage/plugin-techdocs-node to 1.14.7 or later for the 1.14.x line, 1.15.5 or later for the 1.15.x line, or 2.0.0 or later for the mainline. These updates remove MkDocs plugins outside the built-in allowlist. To retain additional plugins, review and explicitly configure them using 'techdocs.generator.mkdocs.dangerouslyAllowAdditionalPlugins'. Additionally, restrict control of TechDocs source repositories to trusted maintainers, run documentation builders with outbound access to private and link-local networks denied, and require token- or header-protected cloud instance metadata services to prevent unauthorized access.