CVE-2026-29186 Details
Description
Backstage is an open framework for building developer portals. Prior to version 1.14.3, this is a configuration bypass vulnerability that enables arbitrary code execution. The @backstage/plugin-techdocs-node package uses an allowlist to filter dangerous MkDocs configuration keys during the documentation build process. A gap in this allowlist allows attackers to craft an mkdocs.yml that causes arbitrary Python code execution, completely bypassing TechDocs' security controls. This issue has been patched in version 1.14.3.
A configuration bypass vulnerability has been identified in the Backstage TechDocs plugin for Node.js, specifically in version 1.14.2 prior to 1.14.3. This vulnerability allows arbitrary code execution by exploiting a gap in the allowlist used to filter dangerous MkDocs configuration keys during the documentation build process. Attackers can craft a malicious mkdocs.yml file that executes arbitrary Python code, bypassing TechDocs' security controls.
Users can upgrade to Backstage TechDocs Node plugin version 1.14.3 or later. If an immediate upgrade is not possible, consider using Docker mode with restricted access, limiting repository access to trusted contributors, implementing manual review requirements for changes to mkdocs.yml files, or downgrading MkDocs to a version prior to 1.4.0.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://access.redhat.com/errata/RHSA-2026:13826 | redhat-SADP | |
| https://access.redhat.com/errata/RHSA-2026:9742 | redhat-SADP | |
| https://access.redhat.com/security/cve/CVE-2026-29186 | redhat-SADP | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2445480 | redhat-SADP | |
| https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-29186.json | redhat-SADP | |
| https://github.com/backstage/backstage/security/advisories/GHSA-928r-fm4v-mvrw | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-434 | Unrestricted Upload of File with Dangerous Type | [email protected] |
| CWE-434 | Unrestricted Upload of File with Dangerous Type | [email protected] |
| CWE-74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | [email protected] |
| CWE-791 | Incomplete Filtering of Special Elements | redhat-SADP |
Affected Products
| Product | Versions |
|---|---|
| linuxfoundation backstage plugin-techdocs-node | < 1.14.3 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 11, 2026 | Initial Analysis | [email protected] |
| Mar 7, 2026 | New CVE Received | [email protected] |