CVE-2026-106455

Name of the Vulnerable Software and Affected Versions @backstage/plugin-techdocs-node versions 0.11.12 through 1.14.6 @backstage/plugin-techdocs-node versions 1.15.0 through 1.15.4

Description Improper validation of mkdocs plugin configuration in techdocs allows an authenticated attacker with control over a TechDocs source repository to cause a documentation build to retrieve and publish data from network locations reachable by the build environment. The extent of exposure depends on the deployment topology, build mode, and target endpoint protections. Cloud metadata services requiring tokens or special headers are not directly accessible through this behavior.

Recommendations Update @backstage/plugin-techdocs-node to version 1.14.7. Update @backstage/plugin-techdocs-node to version 1.15.5.