요약
- CVE-2026-106490은(는) backstage (linuxfoundation), backstage/plugin-techdocs-backend (linuxfoundation), @backstage/plugin-techdocs-backend에 영향을 주는 보통 (CVSS 6.5) 취약점입니다.
- 향후 30일 내 악용 확률(EPSS): 0.37%, 전체 취약점의 30.9%보다 높음.
- 조치: 1.54.6, 2.2.4 이상으로 업데이트하세요.
Description
Impact
When using the Azure Blob Storage provider, an authenticated Backstage user may be able to read restricted TechDocs content when entity-level permissions are enabled. Deployments that intentionally disable the default backend authentication policy may have broader exposure.
Patches
Patched in @backstage/plugin-techdocs-backend version 2.2.4
Workarounds
- Restrict access to the TechDocs backend to users who are permitted to view all stored documentation until an upgrade can be applied.
- Keep the default backend authentication policy enabled.
NVD description
Backstage is an open framework for building developer portals. Prior to 2.2.4, the @backstage/plugin-techdocs-backend package is affected by improper input validation in techdocs static content requests. When using the Azure Blob Storage provider, an authenticated Backstage user may be able to read restricted TechDocs content when entity-level permissions are enabled. Deployments that intentionally disable the default backend authentication policy may have broader exposure. This issue is fixed in version 2.2.4.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free