[backstage-goalie]

This PR contains the following updates:

Package	Change	Age	Confidence
@backstage/plugin-techdocs-backend (source)	2.2.2 → 2.2.4

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Backstage: Improper input validation in TechDocs static content requests

CVE-2026-106490 / GHSA-7mfx-xg57-53c9

More information

Details

Impact

When using the Azure Blob Storage provider, an authenticated Backstage user may be able to read restricted TechDocs content when entity-level permissions are enabled. Deployments that intentionally disable the default backend authentication policy may have broader exposure.

Patches

Patched in @backstage/plugin-techdocs-backend version 2.2.4

Workarounds

• Restrict access to the TechDocs backend to users who are permitted to view all stored documentation until an upgrade can be applied.
• Keep the default backend authentication policy enabled.

Severity

• CVSS Score: 6.5 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

• https://github.com/backstage/backstage/security/advisories/GHSA-7mfx-xg57-53c9
• https://nvd.nist.gov/vuln/detail/CVE-2026-106490
• https://github.com/backstage/backstage/commit/40ecc4c2e88b0218125b0a3405d1f6315b321974
• https://github.com/backstage/backstage
• https://github.com/backstage/backstage/releases/tag/v1.54.6

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Backstage: Improper authorization enforcement for TechDocs static content

CVE-2026-106489 / GHSA-rg9r-hr7g-5gc2

More information

Details

Impact

An authenticated user with access to one TechDocs documentation site could craft a URL able to read documentation belonging to a different entity. This only affects deployments using the external TechDocs builder with an external storage provider (S3, GCS, etc.) and the permission framework enabled. Instances that do not use the permission framework are unaffected, since TechDocs content is visible to all authenticated users by design.

Patches

Patched in @backstage/plugin-techdocs-backend version 2.2.4

Workarounds

• None other than upgrading. Deployments that serve TechDocs from local storage are not affected.

Severity

• CVSS Score: 6.5 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

• https://github.com/backstage/backstage/security/advisories/GHSA-rg9r-hr7g-5gc2
• https://nvd.nist.gov/vuln/detail/CVE-2026-106489
• https://github.com/backstage/backstage/commit/bf6bbf7326ada7d96d7b2c4ebc4a71546106f311
• https://github.com/backstage/backstage
• https://github.com/backstage/backstage/releases/tag/v1.54.6

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

backstage/backstage (@​backstage/plugin-techdocs-backend)

v2.2.4

Compare Source

v2.2.3

Compare Source

Patch Changes

• Updated dependencies
  • @​backstage/catalog-model@1.10.0
  • @​backstage/plugin-techdocs-node@1.15.3
  • @​backstage/backend-plugin-api@1.10.0
  • @​backstage/integration@2.1.0
  • @​backstage/plugin-catalog-node@2.2.4

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.