CVE-2026-29186Disclosure(linuxfoundation / backstage_plugin-techdocs-node)

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch linuxfoundation backstage_plugin-techdocs-node systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Backstage is an open framework for building developer portals. Prior to version 1.14.3, this is a configuration bypass vulnerability that enables arbitrary code execution. The @backstage/plugin-techdocs-node package uses an allowlist to filter dangerous MkDocs configuration keys during the documentation build process. A gap in this allowlist allows attackers to craft an mkdocs.yml that causes arbitrary Python code execution, completely bypassing TechDocs' security controls. This issue has been patched in version 1.14.3.

linuxfoundation CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://github.com/backstage/backstage/security/advisories/GHSA-928r-fm4v-mvrw

Other references

Weakness type (CWE)

CWE-74CWE-434CWE-791

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

backstage_plugin-techdocs-node

Threat summary

Patch or workaround signal is available
3 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 3 signals
Disclosure: 3 classified signals
Peaked 1d ago at 2 mentions (2026-03-07); latest day: 1
3 total mentions across 2 days

Affected systems

Vendors

linuxfoundation

Products

backstage_plugin-techdocs-node

Deep dive

Activity timeline3 mentions / 2d

Signal classification1 categories

Disclosure

3100.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-03-07	2	Disclosure2
2026-03-12	1	Disclosure1

Full discourse3 posts

CRAC Learning - Tech@cracbot211d
Disclosure
CVE-2026-29186 (CVSS:7.7, HIGH) is Analyzed. Backstage is an open framework for building developer portals. Prior to version 1.14.3, this is a configuration bypass v..https://nvd.nist.gov/vuln/detail/CVE-2026-29186 #cybersecurityawareness #cybersecurity #CVE #infosec #hacker #nvd #mitre
Post summary
The post reports a high‑severity configuration bypass in Backstage (CVE-2026-29186) affecting versions prior to 1.14.3, with details sourced from the NVD, but provides no PoC, exploit code, or patch information.
0000017
172 followersView on X
CVE@CVEnew215d
Disclosure
CVE-2026-29186 Backstage is an open framework for building developer portals. Prior to version 1.14.3, this is a configuration bypass vulnerability that enables arbitrary code execu… https://www.cve.org/CVERecord?id=CVE-2026-29186
Post summary
The entry describes a Backstage framework configuration bypass that allows arbitrary code execution, noting that versions before 1.14.3 are vulnerable and that updating to version 1.14.3 or newer provides a fix.
00000110
56.6K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds216d
Disclosure
CVE-2026-29186 Arbitrary Code Execution in Backstage TechDocs via MkDocs Configuration ... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-29186 Vulnerability Notification: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=3
Post summary
The tweet announces the disclosure of CVE-2026-29186, detailing an arbitrary code execution flaw in Backstage TechDocs via MkDocs configuration, and links to further vulnerability information.
0000046
4.0K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	linuxfoundation	backstage_plugin-techdocs-node	-	-	-

Explore more

Back to dashboard linuxfoundation CVEs backstage_plugin-techdocs-node vulnerabilities