Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: renovatebot renovate 44.60.1 Clear all filters
TI-2026-74557 CVE-2026-110867 · GHSA-6mj2-rf27-53xc

Renovate allowlist bypass: presets override restricted env vars

Priority MEDIUM 41

Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repositories to set restricted environment variables by placing env inside a shared preset.

CVSS 4.0CRITICAL 9.0 Network Low privileges No interaction EPSS 0.00277 Published 2026-10-14 Fixed in 44.60.1, 15.5.0 +1 CWE-863
TI-2026-74555 CVE-2026-110865

Renovate allowlist bypass lets repository users inject HTTP headers

Priority LOW 30

Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repository users to evade the allowedHeaders restriction by placing hostRules headers inside shared presets.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00185 Published 2026-10-14 Fixed in 44.60.1, 15.5.0 +1 CWE-424