Allowlist Bypass Vulnerability in Renovate by Renofate
CVE-2026-110865

7.1HIGH

Key Information:

Vendor

Renovatebot

Status
Renovate
Renovate-ce
Renovate-ee-server
Renovate-ee-worker
Vendor
CVE Published:
14 October 2026

What is CVE-2026-110865?

The Renovate tool prior to version 44.60.1 is vulnerable to an allowlist bypass, which permits malicious users to circumvent the allowedHeaders restrictions. This is achieved by manipulating hostRules headers within shared presets, allowing attackers to inject arbitrary HTTP headers into outgoing requests. This exploitation can lead to unauthorized access to sensitive information and manipulation of the requests sent by Renovate to various hosts.

Affected Version(s)

mend-renovate-ce helm chart 0 < 15.5.0

mend-renovate-enterprise-edition helm chart 0 < 10.5.0

renovate 0 < 44.60.1

References

https://github.com/renovatebot/renovate/security/advisori...
vendor-advisory
https://www.vulncheck.com/advisories/renovate-before-44.6...
third-party-advisory

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

jamietanna
.