CVE-2026-106490

medium

Backstage is an open framework for building developer portals.

Vendor / product: Linuxfoundation — backstage\/plugin-techdocs-backend

Backstage is an open framework for building developer portals. Prior to 2.2.4, the @backstage/plugin-techdocs-backend package is affected by improper input validation in techdocs static content requests. When using the Azure Blob Storage provider, an authenticated Backstage user may be able to read restricted TechDocs content when entity-level permissions are enabled. Deployments that intentionally disable the default backend authentication policy may have broader exposure. This issue is fixed in version 2.2.4.

CVSS

6.5

6.5 (CVSS v3.1)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Severity source: NVD CVSS v3.1 (security-advisories@github.com)

Timeline (UTC)

Published: 2026-10-06 21:17

Modified: 2026-10-22 14:40

NVD status: Analyzed

Last synced 2 days ago

Verified against the source API 2026-10-27 06:58 UTC

Exploitation

Not listed in CISA KEV (as of last catalog sync)

Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).

Affected products

linuxfoundation / backstage\/plugin-techdocs-backend <2.2.4

linuxfoundation / backstage <1.54.6

Weakness classification (CWE)

CWE-22 CWE-23

Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.

Mitigation & advisories

Vendor advisory: https://github.com/backstage/backstage/security/advisories/GHSA-7mfx-xg57-53c9

Patch / mitigation: https://github.com/backstage/backstage/commit/40ecc4c2e88b0218125b0a3405d1f6315b321974

Patch / mitigation: https://github.com/backstage/backstage/releases/tag/v1.54.6

Patch / mitigation: https://github.com/backstage/backstage/security/advisories/GHSA-7mfx-xg57-53c9

References

https://github.com/backstage/backstage/commit/40ecc4c2e88b0218125b0a3405d1f6315b321974 security-advisories@github.com
https://github.com/backstage/backstage/releases/tag/v1.54.6 security-advisories@github.com
https://github.com/backstage/backstage/security/advisories/GHSA-7mfx-xg57-53c9 security-advisories@github.com

Data sources

NVD CVE API 2.0 — fetched 2026-10-27 06:58 UTC · record ↗

Learn the basics

Understanding CVEs and CVSS Scores

CVE-2026-106490

Affected products

Weakness classification (CWE)

Mitigation & advisories

References

Data sources

Learn the basics

Related CVEs