CVE-2026-106489

Executive Summary

CVE-2026-106489 is an improper authorization vulnerability in the Backstage @backstage/plugin-techdocs-backend package affecting versions prior to 2.2.4. An authenticated user who legitimately has access to one TechDocs documentation site can craft a URL to read documentation belonging to a different entity, resulting in cross-tenant information disclosure. The issue only manifests in deployments using the external TechDocs builder with an external storage provider (S3, GCS, etc.) and the permission framework enabled, and is fixed in version 2.2.4.

Technical Analysis

Backstage is an open framework for building developer portals, and TechDocs is its documentation subsystem. The vulnerability class is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, i.e., path traversal), exploited in an authorization context. The NVD description states the root cause is "improper authorization enforcement for techdocs static content."

The attack mechanism operates on the TechDocs static content delivery path. In affected deployments, TechDocs content is built by an external builder and stored in an external storage provider (S3, GCS, etc.), then served to authenticated users. The backend is expected to enforce two controls: (1) that the requesting user is authenticated, and (2) — when the permission framework is enabled — that the user is authorized for the specific entity whose documentation is requested. The flaw is that authorization enforcement for static content is incomplete: a user with access to one documentation site can construct a URL that resolves to documentation belonging to a different entity.

Because the served content is static, path or entity-resolution handling is the relevant surface. A crafted URL can traverse or otherwise redirect the content lookup away from the user's authorized entity toward another entity's documentation. The result is horizontal privilege escalation / cross-entity data exposure.

Two deployment preconditions are explicit in the description:

• The external TechDocs builder with an external storage provider (S3, GCS, etc.) is in use.
• The permission framework is enabled.

The description explicitly notes that instances not using the permission framework are unaffected, "since TechDocs content is visible to all authenticated users by design." This is an important scoping constraint: in those deployments, cross-site read access is expected behavior rather than a vulnerability. The security boundary that CVE-2026-106489 breaks exists only where the permission framework is intended to restrict TechDocs content to authorized entities.

No public proof-of-concept, exploit code, or Nuclei template is available. No function names, class names, URL endpoints, API paths, file paths, or parameter names beyond those appearing verbatim in the NVD description are provided; therefore no code-level implementation specifics can be asserted here. No public technical detail beyond the vendor description is available.

EPSS has not yet been scored by FIRST.org, so no probability estimate is cited. CISA KEV does not list this CVE.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class and the described preconditions.

1. Reconnaissance / target identification. The attacker requires authenticated access to the target Backstage portal. They identify that TechDocs is in use and that the deployment matches the affected profile (external TechDocs builder with an external storage provider such as S3 or GCS, and the permission framework enabled). The attacker notes an entity whose documentation they are legitimately authorized to view, and via normal portal browsing identifies or guesses the identity of other entities whose documentation they are not authorized to view.

2. Triggering the flaw class. The attacker navigates to the TechDocs static content path for their own authorized entity, then modifies the requested URL so that the content lookup resolves to a different entity. The improper authorization enforcement on the static content endpoint means the backend does not re-validate the requesting user's permission against the entity targeted by the crafted URL.

3. Execution / payload method. This is a request-tampering attack at the URL layer: the attacker issues HTTP requests (directly or by URL manipulation in the browser) carrying a crafted path that points to another entity's documentation. No code execution or injected payload is required; the "payload" is the altered URL itself.

4. Post-exploitation impact. Successful exploitation yields unauthorized read access to TechDocs documentation belonging to other entities — potentially exposing internal architecture notes, runbooks, credentials accidentally committed to docs, or other sensitive documentation. The impact is confidentiality-only (CVSS C:H/I:N/A:N). An attacker can enumerate and read across documentation sites within the portal, effectively bypassing the permission framework's intended TechDocs authorization boundary.

Impact Assessment

CVE-2026-106489 has a CVSS v3.1 base score of 6.5 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. The subscores indicate: network-attackable (AV:N), low attack complexity (AC:L), requiring low privileges (PR:L — the attacker is an authenticated user), no user interaction (UI:N), unchanged scope (S:U), high confidentiality impact (C:H), and no integrity or availability impact (I:N/A:N).

Business impact centers on information disclosure of internal documentation across entity boundaries. Affected systems are developer portals running Backstage with the @backstage/plugin-techdocs-backend package below 2.2.4, specifically those using the external TechDocs builder with external storage and the permission framework enabled. The blast radius is bounded by the number of documentation sites within the portal and the sensitivity of their contents; because the attacker must already be authenticated and can read across entities, the primary risk is lateral exposure of documentation intended to be restricted to specific teams or entities. No integrity or availability effects are expected. No exploit activity in the wild or threat-actor association has been reported.

Detection Guidance

Sigma Rule

title: Backstage TechDocs Cross-Entity Documentation Access Attempt
id: 8f2c1a4e-7b3d-4e9a-9c21-5d6e0f1a2b3c
status: experimental
description: Detects requests to Backstage TechDocs static content paths where the requested entity does not match the entity associated with the authenticated user session (potential CVE-2026-106489 exploitation).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-106489
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_techdocs:
    cs-uri-stem|contains:
      - '/api/techdocs/'
      - '/techdocs/'
  selection_static:
    cs-uri-stem|contains:
      - 'static'
      - 'docs'
  filter_authorized:
    user_entity: '%{session.user_entity}'
  condition: selection_techdocs and selection_static
fields:
  - c-ip
  - cs-uri-stem
  - cs-uri-query
  - cs-username
falsepositives:
  - Legitimate cross-entity documentation browsing where permissions allow it
  - Load balancer or health-check requests
level: medium
tags:
  - attack.t1190
  - cve.2026-106489

YARA Rule

rule CVE_2026_106489_Backstage_TechDocs_Traversal
{
    meta:
        description = "Detects path traversal patterns targeting Backstage TechDocs static content (CVE-2026-106489)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-106489"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $td1 = "techdocs" nocase
        $td2 = "static" nocase
        $trav1 = "../" ascii
        $trav2 = "..%2f" nocase
        $trav3 = "..%5c" nocase
        $trav4 = "%2e%2e%2f" nocase
        $api = "/api/techdocs/" nocase

    condition:
        uint16(0) == 0x4854 and
        ($td1 or $api) and
        ($trav1 or $trav2 or $trav3 or $trav4)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-106489 Backstage TechDocs Cross-Entity Access Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"techdocs"; nocase; http.uri; content:"static"; nocase; http.uri; pcre:"/(\.\.\/|\.\.%2f|%2e%2e%2f|\.\.%5c)/i"; reference:cve,2026-106489; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-106489; classtype:attempted-recon; sid:2026106489; rev:1;)

Elastic Detection

sequence by user.name with maxspan=1m
  [http where http.request.method == "GET" and
    stringContains(http.request.path, "techdocs")]
  [http where http.request.method == "GET" and
    stringContains(http.request.path, "static") and
    (stringContains(http.request.path, "../") or
     stringContains(http.request.path, "..%2f") or
     stringContains(http.request.path, "%2e%2e"))]

Splunk SPL Query

index=web sourcetype=access_combined
| eval uri=lower(uri)
| where (like(uri, "%techdocs%") AND like(uri, "%static%"))
| where (like(uri, "%../%") OR like(uri, "%..%2f%") OR like(uri, "%2e%2e%2f%") OR like(uri, "%..%5c%"))
| stats count min(_time) as first_seen max(_time) as last_seen values(uri) as uris by src_ip, user
| where count >= 1
| sort - count

Wazuh OSSEC Rule

<group name="web,backstage,cve-2026-106489,">
  <rule id="2026106" level="10">
    <if_sid>31100</if_sid>
    <url>/api/techdocs/</url>
    <url>static</url>
    <regex>/[^/]*techdocs[^/]*/i</regex>
    <description>CVE-2026-106489: Possible Backstage TechDocs cross-entity documentation access attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_106489,</group>
  </rule>
  <rule id="2026107" level="12">
    <if_sid>2026106</if_sid>
    <regex>(\.\./|\.\.%2f|%2e%2e%2f|\.\.%5c)</regex>
    <description>CVE-2026-106489: Backstage TechDocs traversal pattern detected in URL</description>
    <group>cve_2026_106489,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No workarounds are documented in the available data.

1. Immediate mitigations:

• Upgrade @backstage/plugin-techdocs-backend to version 2.2.4 or later, which the NVD description states fixes the issue. Because no patch evidence is tracked from tracked sources and no vendor fix or workaround is recorded here, treat upgrade as the primary and definitive action and validate it against the official Backstage release source.
• If upgrade cannot be performed immediately, consider temporarily disabling the permission framework for TechDocs only if doing so does not increase net exposure, or restricting TechDocs access to trusted user populations. Note that the description states deployments without the permission framework are unaffected because TechDocs content is visible to all authenticated users by design; disabling permissions changes the security model and should be assessed against your data-classification requirements.
• Reduce the exposed blast radius by ensuring that sensitive material (credentials, secrets, runbooks) is not stored in TechDocs content.

2. Patch / upgrade steps:

• Identify all Backstage deployments and confirm whether the external TechDocs builder with an external storage provider (S3, GCS, etc.) and the permission framework are enabled.
• Update the @backstage/plugin-techdocs-backend package to 2.2.4+ and rebuild/redeploy the backend.
• Verify the @backstage/plugin-techdocs-backend version in lockfiles and container images post-upgrade.

3. Long-term hardening:

• Enforce entity-scoped authorization checks on all TechDocs static content requests, consistent with the permission framework's intent.
• Monitor web access logs for cross-entity TechDocs URL manipulation using the detection rules above.
• Maintain an inventory of packages and dependency versions to enable rapid response to future TechDocs advisories.
• Consider least-privilege storage configuration (scoped S3/GCS credentials) to limit the impact of any documentation-access bypass.

References

• NVD — CVE-2026-106489: https://nvd.nist.gov/vuln/detail/CVE-2026-106489
• Backstage project release/advisory source for @backstage/plugin-techdocs-backend 2.2.4 (per NVD description)
• Backstage TechDocs documentation and permissions framework documentation: https://backstage.io/docs
• CWE-22 — Improper Limitation of a Pathname to a Restricted Directory: https://cwe.mitre.org/data/definitions/22.html
• CISA Known Exploited Vulnerabilities Catalog (CVE not listed as of this writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns or exploit-in-the-wild evidence have been identified for this CVE.