Protection Mechanism Bypass in Renovate by Renovate Bot

CVE-2026-110866

What is CVE-2026-110866?

Renovate versions prior to 44.61.3 contain a vulnerability that allows attackers to circumvent minimumReleaseAge checks. By exploiting this flaw, users can use the rebase/retry feature to request a PR rebase without adhering to the specified minimum release age. This can permit maliciously published dependency versions to be integrated and executed in the CI/CD pipeline before they are due, potentially exposing systems to risks associated with unvetted code. For more information, refer to the GitHub Security Advisory and the VulnCheck Advisory.

References