Backstage TechDocs CVE-2026-29186
CRITICAL
GHSA-928r-fm4v-mvrw
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attacker must supply build input (mkdocs.yml) to a processed repo, implying at least low-privilege contributor access, so PR:L rather than PR:N; once supplied, code execution is reliable with full host impact.
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
11DescriptionNVD
Backstage is an open framework for building developer portals. Prior to version 1.14.3, this is a configuration bypass vulnerability that enables arbitrary code execution. The @backstage/plugin-techdocs-node package uses an allowlist to filter dangerous MkDocs configuration keys during the documentation build process. A gap in this allowlist allows attackers to craft an mkdocs.yml that causes arbitrary Python code execution, completely bypassing TechDocs' security controls. This issue has been patched in version 1.14.3.
AnalysisAI
Arbitrary code execution in Backstage's @backstage/plugin-techdocs-node (versions <= 1.14.2) allows attackers who can influence an mkdocs.yml file to run arbitrary Python during the documentation build, bypassing TechDocs' allowlist-based configuration filtering. The flaw stems from MkDocs configuration keys (notably the hooks feature) that the security allowlist failed to block, meaning any contributor able to merge or supply a crafted mkdocs.yml gains code execution on the build host. No public exploit identified at time of analysis, and EPSS is low (0.07%), but the CVSS 9.8 rating and trivial exploitation primitive make this a high-priority patch for self-hosted developer portals.
Technical ContextAI
Backstage TechDocs builds technical documentation from Markdown using MkDocs, a Python static-site generator. To prevent untrusted repository content from compromising the build environment, @backstage/plugin-techdocs-node sanitizes the user-supplied mkdocs.yml against an allowlist of permitted configuration keys. MkDocs 1.4.0 (released 2022-09-27) introduced the 'hooks' key, which loads and executes arbitrary local Python modules at build time; a gap in the allowlist let this and/or other dangerous keys through, so attacker-controlled YAML translates directly into Python code execution. This is an instance of CWE-74 (Improper Neutralization of Special Elements / Injection): untrusted input flows into an interpreter-controlling configuration without adequate filtering. The affected component is identified as cpe:2.3:a:linuxfoundation:backstage_plugin-techdocs-node, and the same code path is reachable via @techdocs/cli in CI/CD because it depends on the same package.
RemediationAI
Vendor-released patch: upgrade @backstage/plugin-techdocs-node to version 1.14.3 or later (and rebuild any @techdocs/cli-based pipelines so they pull the fixed package), per the Backstage advisory at https://github.com/backstage/backstage/security/advisories/GHSA-928r-fm4v-mvrw; Red Hat consumers should apply RHSA-2026:9742 / RHSA-2026:13826. If you cannot upgrade immediately, the vendor recommends layered workarounds, each with trade-offs: set TechDocs to runIn: docker instead of runIn: local for container isolation (reduces but does not eliminate the risk, since the malicious code still runs inside the container); restrict who can modify mkdocs.yml in TechDocs-processed repositories to trusted contributors only; enforce mandatory PR review on mkdocs.yml changes to catch malicious hooks before merge; or pin MkDocs to a version below 1.4.0 (e.g., 1.3.1) which lacks the hooks feature, at the cost of losing newer MkDocs functionality. Note that building docs in CI/CD with @techdocs/cli does NOT mitigate the issue because it uses the same vulnerable package.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
Cross-user flow execution in Langflow (< 1.9.1) lets any authenticated API-key holder run another user's flow by passing
Vendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today