CVE-2026-110865GHSA-6j6f-fh7w-vvjr
Renovate before 44.60.1 HTTP Header Allowlist Bypass via Shared Presets
renovatebot renovate
CVSS
7.1HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.18%Chance of exploitation activity in the next 30 days, higher than 7% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 44.60.1renovateCVE List
- 15.5.0renovate-ceCVE List
- 15.5.0renovate-ee-serverCVE List
- 15.5.0renovate-ee-workerCVE List
- 15.5.0mend-renovate-ce helm chartCVE List
- 10.5.0mend-renovate-enterprise-edition helm chartCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repository users to evade the allowedHeaders restriction by placing hostRules headers inside shared presets. Attackers can supply internal or externally sourced presets with unvalidated hostRules[].headers to inject custom HTTP headers into requests Renovate sends to other hosts.
Text from CVE List
Affected versions 6
- renovateaffected: all versions before 44.60.1CVE List
- renovate-ceaffected: all versions before 15.5.0CVE List
- renovate-ee-serveraffected: all versions before 15.5.0CVE List
- renovate-ee-workeraffected: all versions before 15.5.0CVE List
- mend-renovate-ce helm chartaffected: all versions before 15.5.0CVE List
- mend-renovate-enterprise-edition helm chartaffected: all versions before 10.5.0CVE List