CVE-2026-106455

Summary

The flaw allows authenticated attackers with control over TechDocs source repositories to inject arbitrary network requests during documentation builds, potentially enabling data exfiltration from internal networks reachable by the build environment. This represents a significant information disclosure risk in developer portal deployments.

Exploitability

Moderately difficult to exploit as it requires an authenticated user with write access to a TechDocs repository, but the attack can be automated once the initial access is gained.

Blast radius

The impact could be substantial if exploited, potentially allowing attackers to exfiltrate sensitive data from internal services that are accessible to the documentation build environment, though cloud metadata services requiring tokens remain protected.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to @backstage/plugin-techdocs-node version 1.14.7 or 1.15.5 immediately.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.