Read the docs
TI-2026-74555 Aliases CVE-2026-110865

Renovate allowlist bypass lets repository users inject HTTP headers

Priority LOW 30CWE-424Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
High · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Renovate versions before 44.60.1 contain an allowlist bypass that lets repository users evade the allowedHeaders restriction. Attackers can supply internal or externally sourced shared presets with unvalidated hostRules headers, which Renovate then sends as custom HTTP headers to other hosts. The weakness is classified as CWE-424, an improper protection of alternate path.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repository users to evade the allowedHeaders restriction by placing hostRules headers inside shared presets. Attackers can supply internal or externally sourced presets with unvalidated hostRules[].headers to inject custom HTTP headers into requests Renovate sends to other hosts.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00185 8th percentileScored 2026-11-07
Fix Fixed renovate (renovatebot): 44.60.1renovate-ce (mend): 15.5.0+4 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
renovatebotrenovatebefore 44.60.144.60.1Patch availableCNA
mendrenovate-cebefore 15.5.015.5.0Patch availableCNA
mendrenovate-ee-serverbefore 15.5.015.5.0Patch availableCNA
mendrenovate-ee-workerbefore 15.5.015.5.0Patch availableCNA
mendmend-renovate-ce helm chartbefore 15.5.015.5.0Patch availableCNA
mendmend-renovate-enterprise-edition helm chartbefore 10.5.010.5.0Patch availableCNA
  • renovate Vendorrenovatebot Affected before 44.60.1 Fixed in 44.60.1 Patch available CNA
  • renovate-ce Vendormend Affected before 15.5.0 Fixed in 15.5.0 Patch available CNA
  • renovate-ee-server Vendormend Affected before 15.5.0 Fixed in 15.5.0 Patch available CNA
  • renovate-ee-worker Vendormend Affected before 15.5.0 Fixed in 15.5.0 Patch available CNA
  • mend-renovate-ce helm chart Vendormend Affected before 15.5.0 Fixed in 15.5.0 Patch available CNA
  • mend-renovate-enterprise-edition helm chart Vendormend Affected before 10.5.0 Fixed in 10.5.0 Patch available CNA

Remediation

Update renovatebot renovate to 44.60.1. Update mend renovate-ce, renovate-ee-server, renovate-ee-worker and the mend-renovate-ce helm chart to 15.5.0, and update the mend-renovate-enterprise-edition helm chart to 10.5.0.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA renovate (renovatebot) Fixed in 44.60.1
  • Fix · CNA renovate-ce (mend) Fixed in 15.5.0
  • Fix · CNA renovate-ee-server (mend) Fixed in 15.5.0
  • Fix · CNA renovate-ee-worker (mend) Fixed in 15.5.0
  • Fix · CNA mend-renovate-ce helm chart (mend) Fixed in 15.5.0
  • Fix · CNA mend-renovate-enterprise-edition helm chart (mend) Fixed in 10.5.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    mend-renovate-ce helm chart, mend-renovate-enterprise-edition helm chart and 3 more products 10.5.0, 15.5.0

    3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2026-74557 Renovate allowlist bypass: presets override restricted env varsPriority MEDIUM 41
    • TI-2026-74556 Renovate bypasses minimumReleaseAge checks through PR rebase requestsPriority LOW 23
    Show all 3 records →
  • Release ·

    renovatebot renovate 44.60.1

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-74557 Renovate allowlist bypass: presets override restricted env varsPriority MEDIUM 41
    Show all 2 records →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-15 Threatist record created from CVE-2026-110865
  2. 2026-10-16 Priority changed: MEDIUM → LOW
  3. 2026-10-16 Affected versions changed · Red Hat
  4. 2026-10-16 CVSS score added · Red Hat
  5. 2026-10-26 CISA SSVC decision points changed

References

Advisory 1

  • TI-2026-53338 Renovate 39.53.0 before 40.33.0 Command Injection via gleam manager CVSS 4.0HIGH 8.4
  • TI-2026-53337 Renovate 31.51.0 before 40.33.0 Command Injection via helmv3 CVSS 4.0HIGH 8.4
  • TI-2026-53336 Renovate 32.135.0 before 40.33.0 Command Injection via hermit CVSS 4.0HIGH 8.4
  • TI-2026-53335 Renovate 35.63.0 before 40.33.0 Command Injection via npm CVSS 4.0HIGH 8.4
  • TI-2026-53333 Renovate before 42.68.5 Remote Code Execution via Gradle Wrapper CVSS 4.0HIGH 8.4
  • TI-2026-60271 Renovate before 44.11.2 Credential Exfiltration via Link Header CVSS 4.0CRITICAL 9.2
See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences