Server-Side Request Forgery Vulnerability in Renovate by RenovateBot
CVE-2026-110868

8.4HIGH

Key Information:

Vendor: Renovatebot
Status: Renovate; Renovate-ce; Renovate-ee-server; Renovate-ee-worker
Vendor: CVE Published:; 14 October 2026

🔔 Create Renovatebot Vulnerability Alert

What is CVE-2026-110868?

The Renovate application prior to version 44.79.0 is susceptible to a server-side request forgery (SSRF) vulnerability. This flaw allows an attacker to exploit the shared HTTP client by directing requests to arbitrary internal URLs through extends presets or customDatasources. A successful exploitation can enable attackers to target instance metadata service endpoints, potentially obtaining AWS credentials or leaking sensitive information via Renovate logs. This vulnerability poses a significant risk to users relying on Renovate for automating dependency updates.

Affected Version(s)

mend-renovate-ce helm chart 0 < 15.6.0

mend-renovate-enterprise-edition helm chart 0 < 10.6.0

renovate 0 < 44.79.0

References

https://github.com/renovatebot/renovate/security/advisori...

vendor-advisory

https://www.vulncheck.com/advisories/renovate-before-44.7...

third-party-advisory

CVSS V4

Score:

8.4

Severity:

HIGH

Confidentiality:

High

Integrity:

Low

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Attack Required:

None

Privileges Required:

Undefined

User Interaction:

None

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Oct 14, 2026
Vulnerability Reserved
Oct 14, 2026

Credit

offset

pvaladares

CVE-2026-110868 Data

JSON