« Volver al listado

CVE-2026-106556

Estado: AnalizadaAlta (7.7)—

Backstage es un framework abierto para crear portales de desarrolladores. Antes de 1.14.6, el paquete @backstage/plugin-techdocs-node se ve afectado por una elusión de la configuración en el saneamiento de mkdocs.yml de techdocs. Una validación insuficiente de la configuración de MkDocs durante la generación de TechDocs podría permitir a un usuario autenticado que pueda registrar o modificar fuentes de documentación ejecutar comandos arbitrarios en el entorno de compilación. El impacto se limita a los recursos accesibles para el backend de TechDocs o el contenedor de compilación. Este problema está corregido en las versiones 1.14.6 y 1.15.4.

Traducción automática del texto original de NVD (en inglés).

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

AV:N/PR:L requiere acceso autenticado remoto (T1210). La bypasss de sanitización en mkdocs.yml permite ejecución arbitraria de comandos en el entorno de construcción (T1059). Con contexto de contenedor podría escalar privilegios (T1068).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Threat Intelligence ProgramPrivileged Account ManagementExecution PreventionDisable or Remove Feature or ProgramApplication Isolation and SandboxingExploit Protection

Tecnologías afectadas (2)

Linuxfoundation — BackstageLinuxfoundation — Backstage Plugin-techdocs-node

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-106556",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-106556",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-10-07T16:15:35.192583Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 7.7,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "LOW",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.3,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "backstage",
          "product": "backstage",
          "versions": [
            {
              "status": "affected",
              "version": "< 1.50.5"
            },
            {
              "status": "affected",
              "version": ">= 1.51.0-next.0, < 1.54.6"
            }
          ]
        },
        {
          "vendor": "@backstage",
          "product": "plugin-techdocs-node",
          "versions": [
            {
              "status": "affected",
              "version": "< 1.14.6"
            },
            {
              "status": "affected",
              "version": ">= 1.15.0, < 1.15.4"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-10-07T15:17:12.960",
  "references": [
    {
      "url": "https://github.com/backstage/backstage/commit/25125ee727a3de3418a8fa6a9e458cd5b73ecf26",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/backstage/backstage/commit/b6d1aea0bef99b8dfec3c8746032474867ba677a",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/backstage/backstage/releases/tag/v1.50.5",
      "tags": [
        "Patch",
        "Release Notes"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/backstage/backstage/releases/tag/v1.54.6",
      "tags": [
        "Patch",
        "Release Notes"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/backstage/backstage/security/advisories/GHSA-g2hj-v2j6-vfvg",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        },
        {
          "lang": "en",
          "value": "CWE-184"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by configuration bypass in techdocs mkdocs.yml sanitization. Insufficient validation of MkDocs configuration during TechDocs generation could allow an authenticated user who can register or modify documentation sources to execute arbitrary commands in the build environment. Impact is limited to resources accessible to the TechDocs backend or build container. This issue is fixed in versions 1.14.6 and 1.15.4."
    }
  ],
  "lastModified": "2026-10-13T14:25:23.130",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FEBB527C-B9CC-4ACD-ACE6-5E42C47576B7",
              "versionEndExcluding": "1.50.5"
            },
            {
              "criteria": "cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "949CA2FA-BF88-425F-910D-3D7E817E6420",
              "versionEndExcluding": "1.54.6",
              "versionStartIncluding": "1.51.1"
            },
            {
              "criteria": "cpe:2.3:a:linuxfoundation:backstage:1.51.0:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "91628A7C-3017-4ACD-A100-330BB9F983B2"
            },
            {
              "criteria": "cpe:2.3:a:linuxfoundation:backstage:1.51.0:next0:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C5AEDDFD-39AE-4D5C-91C8-49DA83DF407F"
            },
            {
              "criteria": "cpe:2.3:a:linuxfoundation:backstage:1.51.0:next1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8C1DE1E3-862E-4512-A66B-9804B2451D7F"
            },
            {
              "criteria": "cpe:2.3:a:linuxfoundation:backstage:1.51.0:next2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C5D0AF99-42C1-4AD2-84D6-11327EFD314B"
            },
            {
              "criteria": "cpe:2.3:a:linuxfoundation:backstage:1.51.0:next3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3796F724-6F1F-45CA-BB1F-5F2DCCC37986"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:linuxfoundation:backstage_plugin-techdocs-node:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F5189301-5EC3-4F9F-952B-7993F3BFBF06",
              "versionEndExcluding": "1.14.6"
            },
            {
              "criteria": "cpe:2.3:a:linuxfoundation:backstage_plugin-techdocs-node:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5CB4C5CD-5A68-42D5-AE7F-65362C0E7165",
              "versionEndExcluding": "1.15.4",
              "versionStartIncluding": "1.15.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}