CVE-2026-29186
Prior to version 1.14.3, this is a configuration bypass vulnerability that enables arbitrary code execution.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.78%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Backstage is an open framework for building developer portals. Prior to version 1.14.3, this is a configuration bypass vulnerability that enables arbitrary code execution. The @backstage/plugin-techdocs-node package uses an allowlist to filter dangerous MkDocs configuration keys during the documentation build process. A gap in this allowlist allows attackers to craft an mkdocs.yml that causes arbitrary Python code execution, completely bypassing TechDocs' security controls. This issue has been patched in version 1.14.3.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.78% probability · 54th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-74, CWE-434, CWE-791
- Affected
- linuxfoundation/backstage plugin-techdocs-node
- Source
- security-advisories@github.com
References
- https://github.com/backstage/backstage/security/advisories/GHSA-928r-fm4v-mvrwVendor Advisory
- https://access.redhat.com/errata/RHSA-2026:13826
- https://access.redhat.com/errata/RHSA-2026:9742
- https://access.redhat.com/security/cve/CVE-2026-29186
- https://bugzilla.redhat.com/show_bug.cgi?id=2445480
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-29186.json
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.