CVE-2026-29186

CVE-2026-29186 is a configuration bypass vulnerability in Backstage's @backstage/plugin-techdocs-node package, affecting versions prior to 1.14.3. This flaw allows an authenticated attacker to craft a malicious mkdocs.yml file, leading to arbitrary Python code execution and bypassing TechDocs' security controls. With a CVSS score of 7.7 (High), the vulnerability has a network attack vector and high attack complexity, potentially resulting in high confidentiality and low integrity/availability impacts. There is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available, though it has received minimal community discussion.