Backstage TechDocs Vulnerability CVE-2026-106455 Exposes Internal Networks via SSRF

A new security vulnerability, CVE-2026-106455, has been identified in the `@backstage/plugin-techdocs-node` package, which is central to Backstage's TechDocs functionality. This Server-Side Request Forgery (SSRF) flaw allows authenticated attackers who can control a TechDocs source repository to trigger outbound requests from the build environment. The root cause is improper validation of MkDocs plugin configurations, enabling the build process to retrieve and publish data from internal network locations. The vulnerability affects versions from 0.11.12 up to 1.14.7 and 1.15.5. This vulnerability is critical for organizations leveraging Backstage as their developer portal, especially those using TechDocs for documentation-as-code. The ability for an authenticated attacker to perform SSRF attacks means that sensitive internal network data could be exposed, depending on the deployment topology and existing network protections. For platform engineers and DevOps teams, this is a stark reminder that even seemingly innocuous integrations, like documentation generators, can introduce significant security risks if not properly secured. The impact extends to any organization where developers have control over repository content that feeds into automated build processes within the internal network. This incident fits into a broader trend of increasing scrutiny on the security of developer platforms and supply chain vulnerabilities. As organizations adopt internal developer portals like Backstage to streamline development workflows and improve developer experience, the attack surface expands. The integration of various tools and plugins, while beneficial for functionality, introduces potential weak points. This particular vulnerability highlights the dangers of insufficient input sanitization and the need for robust security practices throughout the entire software development lifecycle, from code commit to deployment. The industry has seen a rise in supply chain attacks, and this vulnerability, while not a direct supply chain compromise, leverages a similar vector of trust in developer-controlled inputs. Practitioners should prioritize immediate patching of their Backstage instances to versions beyond those affected (1.14.7 or 1.15.5). Beyond patching, it is crucial to implement strong egress filtering and logging on TechDocs builder pods or worker environments to prevent and detect unauthorized outbound connections, especially to internal IP ranges (RFC1918, loopback, or metadata services). Regular security audits of all plugins and integrations within Backstage are recommended. Furthermore, organizations should review their authentication and authorization mechanisms to ensure that only trusted individuals have write access to TechDocs source repositories. Monitoring for anomalous network activity originating from documentation build environments should become a standard practice.