Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: mend-renovate-ce helm chart, mend-renovate-enterprise-edition helm chart and 3 more products 10.5.0, 15.5.0 Clear all filters
TI-2026-74557 CVE-2026-110867 · GHSA-6mj2-rf27-53xc

Renovate allowlist bypass: presets override restricted env vars

Priority MEDIUM 41

Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repositories to set restricted environment variables by placing env inside a shared preset.

CVSS 4.0CRITICAL 9.0 Network Low privileges No interaction EPSS 0.00277 Published 2026-10-14 Fixed in 44.60.1, 15.5.0 +1 CWE-863
TI-2026-74556 CVE-2026-110866

Renovate bypasses minimumReleaseAge checks through PR rebase requests

Priority LOW 23

Renovate before 44.61.3 contains a protection mechanism bypass vulnerability that allows minimumReleaseAge checks to be skipped when a user requests a PR rebase via the rebase/retry checkbox.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00209 Published 2026-10-14 Fixed in 44.61.3, 15.5.0 +1 CWE-693
TI-2026-74555 CVE-2026-110865

Renovate allowlist bypass lets repository users inject HTTP headers

Priority LOW 30

Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repository users to evade the allowedHeaders restriction by placing hostRules headers inside shared presets.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00185 Published 2026-10-14 Fixed in 44.60.1, 15.5.0 +1 CWE-424