EUVD-2026-93986
GHSA-q38j-6vcm-2f5m
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Authenticated repo control gives PR:L; crafting an mkdocs plugin config is low-complexity (AC:L); the build env reaching other systems is a scope change (S:C) with data exfiltration C:H and no integrity/availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4Blast Radius
ecosystem impact- 3 npm packages depend on @backstage/plugin-techdocs-node (3 direct, 0 indirect)
Ecosystem-wide dependent count for version 0.11.12.
DescriptionCVE.org
Backstage is an open framework for building developer portals. From 0.11.12 until 1.14.7 and 1.15.5, the @backstage/plugin-techdocs-node package is affected by improper validation of mkdocs plugin configuration in techdocs. An authenticated attacker with control over a TechDocs source repository could cause a documentation build to retrieve and publish data from network locations reachable by the build environment. Exposure depends on deployment topology, build mode, and target endpoint protections. Modern cloud metadata services that require tokens or special headers are not directly accessible through the affected behavior. This issue is fixed in @backstage/plugin-techdocs-node versions 1.14.7 and 1.15.5.
AnalysisAI
Server-side request forgery in the Backstage @backstage/plugin-techdocs-node package (0.11.12 through 1.14.6, and 1.15.0 through 1.15.4) lets an authenticated user who controls a TechDocs source repository have documentation builds fetch and publish content from network locations reachable by the build environment. The issue is rated CVSS 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N), reflecting a confidentiality-only, scope-changing impact that requires repo write access and a build topology where internal endpoints are reachable without token or special-header protections; newer cloud metadata services that require tokens or custom headers are explicitly not directly accessible. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated attacker with write/control over a repository that serves as a TechDocs source, AND a TechDocs generation pipeline that processes the attacker-supplied mkdocs.yml and loads MkDocs plugins capable of outbound network requests (pre-fix behavior with no plugin allowlist). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but conditional server-side request forgery (CWE-918) issue carrying a CVSS 7.7 (High) with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade @backstage/plugin-techdocs-node to 1.14.7 or 1.15.5 (or later), or move the whole deployment to Backstage v1.50.6, v1.54.8, or v1.55.0; the advisory at github.com/backstage/backstage/security/advisories/GHSA-q38j-6vcm-2f5m documents the fix, and the patch commits 28aa82ae2815988721dd7bbf43cd69c431dcd71b and 9f76ea445088961f68c364764cc4b7734f368fc0 show the allowlist logic. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all deployments of @backstage/plugin-techdocs-node and determine if any fall within the affected ranges (0.11.12 through 1.14.6, or 1.15.0 through 1.15.4). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Backstage is an open platform for building developer portals. Rated critical severity (CVSS 9.9), this vulnerability is
Authenticated Backstage users can retrieve the internal execution data of other users' Scaffolder tasks - notably the Se
Authenticated users who can register or modify a TechDocs documentation source can achieve code execution inside the Bac
Arbitrary Python code execution in Backstage's @backstage/plugin-techdocs-node (versions < 1.13.11 and = 1.14.0) lets a
Authenticated remote code execution in the @backstage/plugin-techdocs-node package shipped with the Backstage developer
Improper task-state validation in the @backstage/plugin-scaffolder-backend plugin (Backstage versions prior to 3.3.1, 3.
Path traversal in the Backstage Scaffolder Bitbucket pull-request publish actions allows an authenticated user who can e
Improper input validation in the @backstage/plugin-scaffolder-backend-module-sentry scaffolder actions (Backstage 0.3.0
@backstage/plugin-scaffolder-backend is the backend for the default Backstage software templates. Rated high severity (C
Improper authentication in the Backstage @backstage/plugin-auth-backend-module-oidc-provider package prior to 0.4.20 let
Improper URL validation in the @backstage/plugin-catalog-backend package of Backstage prior to 3.5.1, 3.6.2, 3.7.2, 3.8.
Improper validation of MkDocs Markdown extension configuration in Backstage's TechDocs Node package (@backstage/plugin-t
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today