CVE-2026-106558
Description
A flaw was found in @backstage/plugin-techdocs-node. An authenticated attacker with permissions to register or modify documentation in a source code management (SCM) repository can bypass configuration sanitization checks. By providing a crafted markdown extension configuration, the attacker can cause unintended Python objects to be loaded and executed in the generator runtime. This issue leads to arbitrary code execution, potentially compromising the host environment and accessing backend credentials or internal network services.
Statement
A flaw of IMPORTANT severity was found in the Backstage @backstage/plugin-techdocs-node package, which is shipped in Red Hat Developer Hub and Red Hat Ansible Automation Platform. The package improperly validates the mapping-style markdown_extensions configuration used by TechDocs. An authenticated attacker who can register or modify documentation in a source code management (SCM) repository can bypass TechDocs sanitization checks by supplying a crafted markdown extension configuration, causing Python objects to be imported and instantiated in the documentation generator runtime, resulting in arbitrary code execution. Successful exploitation can compromise the host environment and expose backend credentials, filesystem data, or internal network services accessible to the generator; impact is greatest when documentation generation runs with backend credentials, filesystem access, or internal network access. Red Hat and CVEORG both rate this flaw CVSS 3.1 score 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), which matches the upstream severity. Red Hat Developer Hub and Red Hat Ansible Automation Platform are affected by this issue, and fixes are being pursued by the responsible Red Hat product engineering teams.
Mitigation
Upstream workarounds for this issue include using external TechDocs generation in an isolated environment without sensitive credentials or host access, and restricting and reviewing changes to documentation configuration before generation. Limiting the ability to register or modify SCM-backed documentation sources to trusted users also reduces exposure. For the affected Red Hat products, a fix is being pursued by the responsible product teams and will be delivered through standard product update channels.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.8 | N/A | 8.8 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
