GHSA-q38j-6vcm-2f5m: SSRF

Q: Who can exploit this issue in practice?

An attacker must be authenticated and able to control a TechDocs source repository. The practical exposure also depends on the deployment topology, build mode, and protections on endpoints reachable from the build environment.

Q: What can the attacker access through a successful exploit?

The attacker can cause a documentation build to retrieve and publish data from network locations reachable by the build environment. Modern cloud metadata services requiring tokens or special headers are not directly accessible through this behavior.

Q: Which versions contain the fix?

Upgrade @backstage/plugin-techdocs-node to 1.14.7 or later on the 1.14.x line, 1.15.5 or later on the 1.15.x line, or 2.0.0 or later on the current mainline. These are available in Backstage v1.50.6, v1.54.8, and v1.55.0 respectively.

Q: Will upgrading affect custom MkDocs plugins?

The update removes MkDocs plugins that are outside the built-in allowlist. Additional plugins must be reviewed and explicitly retained through techdocs.generator.mkdocs.dangerouslyAllowAdditionalPlugins, or by supplying dangerouslyAllowAdditionalPlugins when creating the generator.

Published Oct 7, 2026

Updated

Impact

An authenticated attacker with control over a TechDocs source repository could cause a documentation build to retrieve and publish data from network locations reachable by the build environment. Exposure depends on deployment topology, build mode, and target endpoint protections. Modern cloud metadata services that require tokens or special headers are not directly accessible through the affected behavior.

Patches

Upgrade @backstage/plugin-techdocs-node to a patched version for the applicable release line:

- 1.14.x: upgrade to 1.14.7 or later in that line, available in Backstage v1.50.6. - 1.15.x: upgrade to 1.15.5 or later, available in Backstage v1.54.8. - Current mainline: upgrade to 2.0.0 or later, available in Backstage v1.55.0.

The update removes MkDocs plugins outside the built-in allowlist. To retain additional plugins, review them and configure techdocs.generator.mkdocs.dangerouslyAllowAdditionalPlugins, or supply dangerouslyAllowAdditionalPlugins when creating the generator directly. Plugins supplied through defaultPlugins remain permitted.

Workarounds

- Restrict control of TechDocs source repositories and catalog registration to trusted maintainers. - Run documentation builders with outbound access to private and link-local networks denied. - Require token- or header-protected cloud instance metadata services.

Affected Software

2 affected componentsFixes available

npm/@backstage/plugin-techdocs-node>=1.15.0<1.15.5

1.15.5

npm/@backstage/plugin-techdocs-node>=0.11.12<1.14.7

1.14.7

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade npm/@backstage/plugin-techdocs-node to a version that resolves this vulnerability.
Fixed in 1.15.5
Upgrade
Upgrade npm/@backstage/plugin-techdocs-node to a version that resolves this vulnerability.
Fixed in 1.14.7
Upgrade
Upgrade @backstage/plugin-techdocs-node to a version that resolves this vulnerability.
Fixed in 2.0.0
Upgrade
Upgrade @backstage/plugin-techdocs-node to a version that resolves this vulnerability.
Fixed in 1.14.7
Upgrade
Upgrade @backstage/plugin-techdocs-node to a version that resolves this vulnerability.
Fixed in 1.15.5
Configuration
If retaining additional MkDocs plugins, review them and configure dangerouslyAllowAdditionalPlugins; the same option can be supplied when creating the generator directly.
TechDocs MkDocs generator techdocs.generator.mkdocs.dangerouslyAllowAdditionalPlugins
Compensating control
Require token- or header-protected cloud instance metadata services.
Compensating control
Restrict control of TechDocs source repositories and catalog registration to trusted maintainers.
Compensating control
Run documentation builders with outbound access to private and link-local networks denied.

Event History

Oct 7, 2026

Advisory Published

via GitHub·08:25 PM

Data Sourced

via GitHub·08:25 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

Who can exploit this issue in practice?

An attacker must be authenticated and able to control a TechDocs source repository. The practical exposure also depends on the deployment topology, build mode, and protections on endpoints reachable from the build environment.

What can the attacker access through a successful exploit?

The attacker can cause a documentation build to retrieve and publish data from network locations reachable by the build environment. Modern cloud metadata services requiring tokens or special headers are not directly accessible through this behavior.

Which versions contain the fix?

Upgrade @backstage/plugin-techdocs-node to 1.14.7 or later on the 1.14.x line, 1.15.5 or later on the 1.15.x line, or 2.0.0 or later on the current mainline. These are available in Backstage v1.50.6, v1.54.8, and v1.55.0 respectively.

Will upgrading affect custom MkDocs plugins?

The update removes MkDocs plugins that are outside the built-in allowlist. Additional plugins must be reviewed and explicitly retained through techdocs.generator.mkdocs.dangerouslyAllowAdditionalPlugins, or by supplying dangerouslyAllowAdditionalPlugins when creating the generator.

GHSA-q38j-6vcm-2f5m: SSRF

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue in practice?

What can the attacker access through a successful exploit?

Which versions contain the fix?

Will upgrading affect custom MkDocs plugins?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue in practice?

What can the attacker access through a successful exploit?

Which versions contain the fix?

Will upgrading affect custom MkDocs plugins?