En resumen
- CVE-2026-106490 es una vulnerabilidad MEDIO (CVSS 6.5) que afecta a backstage (linuxfoundation), backstage/plugin-techdocs-backend (linuxfoundation), @backstage/plugin-techdocs-backend.
- Probabilidad de explotación en los próximos 30 días (EPSS): 0.37%, mayor que el 30.9% de las vulnerabilidades.
- Solución: actualizar a 1.54.6, 2.2.4 o posterior.
Description
Impact
When using the Azure Blob Storage provider, an authenticated Backstage user may be able to read restricted TechDocs content when entity-level permissions are enabled. Deployments that intentionally disable the default backend authentication policy may have broader exposure.
Patches
Patched in @backstage/plugin-techdocs-backend version 2.2.4
Workarounds
- Restrict access to the TechDocs backend to users who are permitted to view all stored documentation until an upgrade can be applied.
- Keep the default backend authentication policy enabled.
NVD description
Backstage is an open framework for building developer portals. Prior to 2.2.4, the @backstage/plugin-techdocs-backend package is affected by improper input validation in techdocs static content requests. When using the Azure Blob Storage provider, an authenticated Backstage user may be able to read restricted TechDocs content when entity-level permissions are enabled. Deployments that intentionally disable the default backend authentication policy may have broader exposure. This issue is fixed in version 2.2.4.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free