CVE-2026-106490: Backstage: Improper input validation in TechDocs static content requests

October 7, 2026

When using the Azure Blob Storage provider, an authenticated Backstage user may be able to read restricted TechDocs content when entity-level permissions are enabled. Deployments that intentionally disable the default backend authentication policy may have broader exposure.

References

github.com/advisories/GHSA-7mfx-xg57-53c9
github.com/backstage/backstage/commit/40ecc4c2e88b0218125b0a3405d1f6315b321974
github.com/backstage/backstage/releases/tag/v1.54.6
github.com/backstage/backstage/security/advisories/GHSA-7mfx-xg57-53c9
nvd.nist.gov/vuln/detail/CVE-2026-106490

Code Behaviors & Features

Detect and mitigate CVE-2026-106490 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →