{"schema":"vulnpedia.research/1","cve":"CVE-2026-106558","generated":"2026-10-26T13:52:32.101Z","references":[{"url":"https://github.com/backstage/backstage/security/advisories/GHSA-qmw3-745m-w99g","tags":["x_refsource_CONFIRM","Mitigation","Vendor Advisory","WEB","vendor-reference"],"source":"mitre","sourceId":"GitHub_M","modified":"2026-10-07T14:45:25.679Z","origins":[{"source":"mitre","sourceId":"GitHub_M","modified":"2026-10-07T14:45:25.679Z","url":"https://github.com/backstage/backstage/security/advisories/GHSA-qmw3-745m-w99g"},{"source":"nvd","sourceId":"CVE-2026-106558","modified":"2026-10-13T14:25:12.163","url":"https://github.com/backstage/backstage/security/advisories/GHSA-qmw3-745m-w99g"},{"source":"ghsa","sourceId":"GHSA-qmw3-745m-w99g","url":"https://github.com/backstage/backstage/security/advisories/GHSA-qmw3-745m-w99g"},{"source":"ghsa","sourceId":"GHSA-qmw3-745m-w99g","modified":"2026-10-07T18:15:12.165363848Z","url":"https://github.com/backstage/backstage/security/advisories/GHSA-qmw3-745m-w99g"},{"source":"redhat","sourceId":"CVE-2026-106558","modified":"2026-10-20T23:26:33+00:00","url":"https://github.com/backstage/backstage/security/advisories/GHSA-qmw3-745m-w99g"}]},{"url":"https://github.com/backstage/backstage/commit/32723a0fe4e12ed80535fc65d5331765c55aa91b","tags":["x_refsource_MISC","Patch","WEB","vendor-reference"],"source":"mitre","sourceId":"GitHub_M","modified":"2026-10-07T14:45:25.679Z","origins":[{"source":"mitre","sourceId":"GitHub_M","modified":"2026-10-07T14:45:25.679Z","url":"https://github.com/backstage/backstage/commit/32723a0fe4e12ed80535fc65d5331765c55aa91b"},{"source":"nvd","sourceId":"CVE-2026-106558","modified":"2026-10-13T14:25:12.163","url":"https://github.com/backstage/backstage/commit/32723a0fe4e12ed80535fc65d5331765c55aa91b"},{"source":"ghsa","sourceId":"GHSA-qmw3-745m-w99g","url":"https://github.com/backstage/backstage/commit/32723a0fe4e12ed80535fc65d5331765c55aa91b"},{"source":"ghsa","sourceId":"GHSA-qmw3-745m-w99g","modified":"2026-10-07T18:15:12.165363848Z","url":"https://github.com/backstage/backstage/commit/32723a0fe4e12ed80535fc65d5331765c55aa91b"},{"source":"redhat","sourceId":"CVE-2026-106558","modified":"2026-10-20T23:26:33+00:00","url":"https://github.com/backstage/backstage/commit/32723a0fe4e12ed80535fc65d5331765c55aa91b"}]},{"url":"https://github.com/backstage/backstage/commit/944edb51c8524d3664b18f2d57ba101b1c93b709","tags":["x_refsource_MISC","Patch","WEB","vendor-reference"],"source":"mitre","sourceId":"GitHub_M","modified":"2026-10-07T14:45:25.679Z","origins":[{"source":"mitre","sourceId":"GitHub_M","modified":"2026-10-07T14:45:25.679Z","url":"https://github.com/backstage/backstage/commit/944edb51c8524d3664b18f2d57ba101b1c93b709"},{"source":"nvd","sourceId":"CVE-2026-106558","modified":"2026-10-13T14:25:12.163","url":"https://github.com/backstage/backstage/commit/944edb51c8524d3664b18f2d57ba101b1c93b709"},{"source":"ghsa","sourceId":"GHSA-qmw3-745m-w99g","url":"https://github.com/backstage/backstage/commit/944edb51c8524d3664b18f2d57ba101b1c93b709"},{"source":"ghsa","sourceId":"GHSA-qmw3-745m-w99g","modified":"2026-10-07T18:15:12.165363848Z","url":"https://github.com/backstage/backstage/commit/944edb51c8524d3664b18f2d57ba101b1c93b709"},{"source":"redhat","sourceId":"CVE-2026-106558","modified":"2026-10-20T23:26:33+00:00","url":"https://github.com/backstage/backstage/commit/944edb51c8524d3664b18f2d57ba101b1c93b709"}]},{"url":"https://github.com/backstage/backstage/commit/f18e9abcc6051491862b15e4fc60e69f8d52310c","tags":["x_refsource_MISC","Patch","WEB","vendor-reference"],"source":"mitre","sourceId":"GitHub_M","modified":"2026-10-07T14:45:25.679Z","origins":[{"source":"mitre","sourceId":"GitHub_M","modified":"2026-10-07T14:45:25.679Z","url":"https://github.com/backstage/backstage/commit/f18e9abcc6051491862b15e4fc60e69f8d52310c"},{"source":"nvd","sourceId":"CVE-2026-106558","modified":"2026-10-13T14:25:12.163","url":"https://github.com/backstage/backstage/commit/f18e9abcc6051491862b15e4fc60e69f8d52310c"},{"source":"ghsa","sourceId":"GHSA-qmw3-745m-w99g","url":"https://github.com/backstage/backstage/commit/f18e9abcc6051491862b15e4fc60e69f8d52310c"},{"source":"ghsa","sourceId":"GHSA-qmw3-745m-w99g","modified":"2026-10-07T18:15:12.165363848Z","url":"https://github.com/backstage/backstage/commit/f18e9abcc6051491862b15e4fc60e69f8d52310c"},{"source":"redhat","sourceId":"CVE-2026-106558","modified":"2026-10-20T23:26:33+00:00","url":"https://github.com/backstage/backstage/commit/f18e9abcc6051491862b15e4fc60e69f8d52310c"}]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.50.7","tags":["x_refsource_MISC","Patch","Release Notes","WEB","vendor-reference"],"source":"mitre","sourceId":"GitHub_M","modified":"2026-10-07T14:45:25.679Z","origins":[{"source":"mitre","sourceId":"GitHub_M","modified":"2026-10-07T14:45:25.679Z","url":"https://github.com/backstage/backstage/releases/tag/v1.50.7"},{"source":"nvd","sourceId":"CVE-2026-106558","modified":"2026-10-13T14:25:12.163","url":"https://github.com/backstage/backstage/releases/tag/v1.50.7"},{"source":"ghsa","sourceId":"GHSA-qmw3-745m-w99g","url":"https://github.com/backstage/backstage/releases/tag/v1.50.7"},{"source":"ghsa","sourceId":"GHSA-qmw3-745m-w99g","modified":"2026-10-07T18:15:12.165363848Z","url":"https://github.com/backstage/backstage/releases/tag/v1.50.7"},{"source":"redhat","sourceId":"CVE-2026-106558","modified":"2026-10-20T23:26:33+00:00","url":"https://github.com/backstage/backstage/releases/tag/v1.50.7"}]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.54.9","tags":["x_refsource_MISC","Patch","Release Notes","WEB","vendor-reference"],"source":"mitre","sourceId":"GitHub_M","modified":"2026-10-07T14:45:25.679Z","origins":[{"source":"mitre","sourceId":"GitHub_M","modified":"2026-10-07T14:45:25.679Z","url":"https://github.com/backstage/backstage/releases/tag/v1.54.9"},{"source":"nvd","sourceId":"CVE-2026-106558","modified":"2026-10-13T14:25:12.163","url":"https://github.com/backstage/backstage/releases/tag/v1.54.9"},{"source":"ghsa","sourceId":"GHSA-qmw3-745m-w99g","url":"https://github.com/backstage/backstage/releases/tag/v1.54.9"},{"source":"ghsa","sourceId":"GHSA-qmw3-745m-w99g","modified":"2026-10-07T18:15:12.165363848Z","url":"https://github.com/backstage/backstage/releases/tag/v1.54.9"},{"source":"redhat","sourceId":"CVE-2026-106558","modified":"2026-10-20T23:26:33+00:00","url":"https://github.com/backstage/backstage/releases/tag/v1.54.9"}]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.55.2","tags":["x_refsource_MISC","Patch","Release Notes","WEB","vendor-reference"],"source":"mitre","sourceId":"GitHub_M","modified":"2026-10-07T14:45:25.679Z","origins":[{"source":"mitre","sourceId":"GitHub_M","modified":"2026-10-07T14:45:25.679Z","url":"https://github.com/backstage/backstage/releases/tag/v1.55.2"},{"source":"nvd","sourceId":"CVE-2026-106558","modified":"2026-10-13T14:25:12.163","url":"https://github.com/backstage/backstage/releases/tag/v1.55.2"},{"source":"ghsa","sourceId":"GHSA-qmw3-745m-w99g","url":"https://github.com/backstage/backstage/releases/tag/v1.55.2"},{"source":"ghsa","sourceId":"GHSA-qmw3-745m-w99g","modified":"2026-10-07T18:15:12.165363848Z","url":"https://github.com/backstage/backstage/releases/tag/v1.55.2"},{"source":"redhat","sourceId":"CVE-2026-106558","modified":"2026-10-20T23:26:33+00:00","url":"https://github.com/backstage/backstage/releases/tag/v1.55.2"}]},{"url":"https://osv.dev/vulnerability/GHSA-qmw3-745m-w99g","tags":["ADVISORY"],"source":"ghsa","sourceId":"GHSA-qmw3-745m-w99g","modified":"2026-10-07T18:15:12.165363848Z","origins":[{"source":"ghsa","sourceId":"GHSA-qmw3-745m-w99g","url":"https://osv.dev/vulnerability/GHSA-qmw3-745m-w99g"},{"source":"ghsa","sourceId":"GHSA-qmw3-745m-w99g","modified":"2026-10-07T18:15:12.165363848Z","url":"https://osv.dev/vulnerability/GHSA-qmw3-745m-w99g"}]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106558","tags":["ADVISORY","vendor-reference"],"source":"ghsa","sourceId":"GHSA-qmw3-745m-w99g","modified":"2026-10-07T18:15:12.165363848Z","origins":[{"source":"ghsa","sourceId":"GHSA-qmw3-745m-w99g","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106558"},{"source":"ghsa","sourceId":"GHSA-qmw3-745m-w99g","modified":"2026-10-07T18:15:12.165363848Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106558"},{"source":"redhat","sourceId":"CVE-2026-106558","modified":"2026-10-20T23:26:33+00:00","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106558"}]},{"url":"https://github.com/backstage/backstage","tags":["PACKAGE"],"source":"ghsa","sourceId":"GHSA-qmw3-745m-w99g","modified":"2026-10-07T18:15:12.165363848Z","origins":[{"source":"ghsa","sourceId":"GHSA-qmw3-745m-w99g","url":"https://github.com/backstage/backstage"},{"source":"ghsa","sourceId":"GHSA-qmw3-745m-w99g","modified":"2026-10-07T18:15:12.165363848Z","url":"https://github.com/backstage/backstage"}]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106558.json","tags":["vendor-advisory"],"source":"redhat","sourceId":"CVE-2026-106558","modified":"2026-10-20T23:26:33+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-106558","modified":"2026-10-20T23:26:33+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106558.json"}]},{"url":"https://access.redhat.com/security/cve/CVE-2026-106558","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-106558","modified":"2026-10-20T23:26:33+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-106558","modified":"2026-10-20T23:26:33+00:00","url":"https://access.redhat.com/security/cve/CVE-2026-106558"}]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2547507","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-106558","modified":"2026-10-20T23:26:33+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-106558","modified":"2026-10-20T23:26:33+00:00","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2547507"}]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-106558","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-106558","modified":"2026-10-20T23:26:33+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-106558","modified":"2026-10-20T23:26:33+00:00","url":"https://www.cve.org/CVERecord?id=CVE-2026-106558"}]},{"source":"euvd","sourceId":"EUVD-2026-94371","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-94371","tags":["ADVISORY"],"origins":[{"source":"euvd","sourceId":"EUVD-2026-94371","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-94371"}]}],"packages":[{"source":"ghsa","sourceId":"GHSA-qmw3-745m-w99g","url":"https://osv.dev/vulnerability/GHSA-qmw3-745m-w99g","ecosystem":"npm","name":"@backstage/plugin-techdocs-node","purl":"pkg:npm/%40backstage/plugin-techdocs-node","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.15.4"}]}],"databaseSpecific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-qmw3-745m-w99g/GHSA-qmw3-745m-w99g.json"},"modified":"2026-10-07T18:15:12.165363848Z","origins":[{"source":"ghsa","sourceId":"GHSA-qmw3-745m-w99g","modified":"2026-10-07T18:15:12.165363848Z","url":"https://osv.dev/vulnerability/GHSA-qmw3-745m-w99g"}]}],"pocCandidates":[],"cataloguedPoc":[],"vendorStatements":[{"source":"redhat","sourceId":"CVE-2026-106558","modified":"2026-10-20T23:26:33+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106558.json","productId":"red_hat_developer_hub:rhdh/rhdh-hub-rhel9","product":"rhdh/rhdh-hub-rhel9 as a component of Red Hat Developer Hub","status":"known_affected","remediations":[{"category":"workaround","details":"Upstream workarounds for this issue include using external TechDocs generation in an isolated environment without sensitive credentials or host access, and restricting and reviewing changes to documentation configuration before generation. Limiting the ability to register or modify SCM-backed documentation sources to trusted users also reduces exposure. For the affected Red Hat products, a fix is being pursued by the responsible product teams and will be delivered through standard product update channels."},{"category":"none_available","details":"Affected"}],"purl":"pkg:oci/rhdh-hub-rhel9@sha256:6d6fb29bd26ff5f8ee2df1302cc228c1358a9dfde83f9609f0f6e24e8a6be7c4?repository_url=registry.redhat.io/rhdh/rhdh-hub-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-106558","modified":"2026-10-20T23:26:33+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106558.json"}]},{"source":"redhat","sourceId":"CVE-2026-106558","modified":"2026-10-20T23:26:33+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106558.json","productId":"self-service_automation_portal_2:ansible-automation-platform/automation-portal","product":"ansible-automation-platform/automation-portal as a component of Self-service automation portal 2","status":"known_affected","remediations":[{"category":"workaround","details":"Upstream workarounds for this issue include using external TechDocs generation in an isolated environment without sensitive credentials or host access, and restricting and reviewing changes to documentation configuration before generation. Limiting the ability to register or modify SCM-backed documentation sources to trusted users also reduces exposure. For the affected Red Hat products, a fix is being pursued by the responsible product teams and will be delivered through standard product update channels."},{"category":"none_available","details":"Affected"}],"purl":"pkg:oci/automation-portal@sha256:ca5c8160a6cb0fa122c3cc91852325af72b9713db1c2683b68e91433b762e604?repository_url=registry.redhat.io/ansible-automation-platform/automation-portal","origins":[{"source":"redhat","sourceId":"CVE-2026-106558","modified":"2026-10-20T23:26:33+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106558.json"}]},{"source":"redhat","sourceId":"CVE-2026-106558","modified":"2026-10-20T23:26:33+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106558.json","productId":"self-service_automation_portal_2:ansible-automation-platform/bootc-automation-portal-rhel9","product":"ansible-automation-platform/bootc-automation-portal-rhel9 as a component of Self-service automation portal 2","status":"known_affected","remediations":[{"category":"workaround","details":"Upstream workarounds for this issue include using external TechDocs generation in an isolated environment without sensitive credentials or host access, and restricting and reviewing changes to documentation configuration before generation. Limiting the ability to register or modify SCM-backed documentation sources to trusted users also reduces exposure. For the affected Red Hat products, a fix is being pursued by the responsible product teams and will be delivered through standard product update channels."},{"category":"none_available","details":"Affected"}],"purl":"pkg:oci/bootc-automation-portal-rhel9@sha256:58480702819796209b8cda6fe1b53ad78870575432da34ecfdc20cd446c8d81b?repository_url=registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-106558","modified":"2026-10-20T23:26:33+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106558.json"}]}],"vendorCoverage":{"total":3,"shown":3,"omitted":0,"source":"redhat"}}