CVE-2026-106557: Backstage has improper input validation in TechDocs Markdown extension configuration
An authenticated user who can register or modify documentation sources may cause a TechDocs build to access resources outside the intended documentation boundary. Depending on deployment configuration, this may expose sensitive backend-host data or internal network resources.
References
- github.com/advisories/GHSA-f7v3-xhm6-w245
- github.com/backstage/backstage/commit/017ace52d9b327ededc6704cf17799c875ae0f29
- github.com/backstage/backstage/commit/2d9de4ca117a529de4b6ed7dfb7aa507ca7b3f91
- github.com/backstage/backstage/releases/tag/v1.50.5
- github.com/backstage/backstage/releases/tag/v1.54.6
- github.com/backstage/backstage/security/advisories/GHSA-f7v3-xhm6-w245
- nvd.nist.gov/vuln/detail/CVE-2026-106557
Code Behaviors & Features
Detect and mitigate CVE-2026-106557 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →