CVE-2026-106510
Description
A flaw was found in plugin-techdocs-node. An authenticated attacker with permissions to register catalog entities can achieve arbitrary code execution by submitting a crafted documentation configuration file. When the documentation is built, the malicious markdown extensions setting triggers execution of arbitrary operating system commands on the build host.
Statement
This vulnerability is rated as Important because authenticated users permitted to register catalog entities can trigger arbitrary system commands on the backend build host. In Red Hat Developer Hub and Ansible Automation Platform environments utilizing in-tree TechDocs generation, an attacker can leverage malicious documentation configurations to compromise the host system. The impact is limited to deployments where untrusted catalog ingestion is permitted and documentation builds are not delegated to isolated external runners.
Mitigation
To mitigate this vulnerability, implement the following operational and configuration controls:
1. Isolate documentation builds:
Configure TechDocs to delegate builds to an external pipeline rather than executing them locally on the portal host. In `app-config.yaml`, set:
yaml
techdocs:
builder: 'external'
Warning: Applying configuration changes to `app-config.yaml` requires restarting or redeploying the service to take effect. Delegating to external builders requires generating documentation through external CI/CD pipelines or dedicated build runners.
2. Restrict catalog registration:
Restrict catalog registration privileges to authorized administrators through role-based access control (RBAC) and permission policies, preventing untrusted users from registering components with custom documentation paths.
3. Audit catalog repositories:
Inspect existing entity repositories and their `mkdocs.yml` files for untrusted or unexpected `markdown_extensions` declarations before documentation builds are processed.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.7 | N/A | 7.7 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Changed | N/A | Changed |
| Confidentiality | High | N/A | High |
| Integrity Impact | Low | N/A | Low |
| Availability Impact | Low | N/A | Low |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L
cve.org: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L
Understanding the Weakness (CWE)
Confidentiality,Integrity,Availability,Non-Repudiation
Technical Impact: Execute Unauthorized Code or Commands; DoS: Crash, Exit, or Restart; Read Files or Directories; Modify Files or Directories; Read Application Data; Modify Application Data; Hide Activities
Attackers could execute unauthorized operating system commands, which could then be used to disable the product, or read and modify data for which the attacker does not have permissions to access directly. Since the targeted application is directly executing the commands instead of the attacker, any malicious activities may appear to come from the application or the application's owner.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
