All vulnerabilities
CVE-2026-110867GHSA-4g23-2xm8-66gcGHSA-6873-xr44-22vm

Renovate before 44.60.1 allowedEnv Allowlist Bypass via Shared Preset

renovatebot renovate
Open in ThreatlineRecord JSON
CVSS
9.0Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.28%Chance of exploitation activity in the next 30 days, higher than 19% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in44.60.1Also 15.5.0, 10.5.0CVE List
Published14 Oct 2026Updated 15 Oct 2026CVE List

What fixes it

Show all 23 fixed versions
  • 44.60.1renovate, npmGitHubnpm install renovate@44.60.1
  • 44.60.1renovate/renovate, dockerGitHub
  • 44.60.1docker.io/renovate/renovate, dockerGitHub
  • 44.60.1ghcr.io/renovate/renovate, dockerGitHub
  • 15.5.0mend/renovate-ce, dockerGitHub
  • 15.5.0docker.io/mend/renovate-ce, dockerGitHub
  • 15.5.0ghcr.io/mend/renovate-ce, dockerGitHub
  • 15.5.0mend/renovate-ee-server, dockerGitHub
  • 15.5.0docker.io/mend/renovate-ee-server, dockerGitHub
  • 15.5.0ghcr.io/mend/renovate-ee-server, dockerGitHub
  • 15.5.0mend/renovate-ee-worker, dockerGitHub
  • 15.5.0docker.io/mend/renovate-ee-worker, dockerGitHub
  • 15.5.0ghcr.io/mend/renovate-ee-worker, dockerGitHub
  • 15.5.0ghcr.io/mend/charts/mend-renovate-ce, dockerGitHub
  • 15.5.0mend-renovate-ce, dockerGitHub
  • 10.5.0ghcr.io/mend/charts/mend-renovate-enterprise-edition, dockerGitHub
  • 10.5.0mend-renovate-enterprise-edition, dockerGitHub

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repositories to set restricted environment variables by placing env inside a shared preset. Attackers controlling an externally sourced preset can override variables like PATH, LD_PRELOAD, NODE_OPTIONS, or GIT_SSL_CAINFO in child processes on self-hosted instances.

Text from CVE List

Affected versions 23

  • renovateaffected: all versions before 44.60.1CVE List
  • renovate-ceaffected: all versions before 15.5.0CVE List
  • renovate-ee-serveraffected: all versions before 15.5.0CVE List
  • renovate-ee-workeraffected: all versions before 15.5.0CVE List
  • mend-renovate-ce helm chartaffected: all versions before 15.5.0CVE List
  • mend-renovate-enterprise-edition helm chartaffected: all versions before 10.5.0CVE List
  • renovate, npm<44.60.1GitHub
  • renovate/renovate, docker<44.60.1GitHub
  • docker.io/renovate/renovate, docker<44.60.1GitHub
  • ghcr.io/renovate/renovate, docker<44.60.1GitHub
  • mend/renovate-ce, docker<15.5.0GitHub
  • docker.io/mend/renovate-ce, docker<15.5.0GitHub
  • ghcr.io/mend/renovate-ce, docker<15.5.0GitHub
  • mend/renovate-ee-server, docker<15.5.0GitHub
  • docker.io/mend/renovate-ee-server, docker<15.5.0GitHub
  • ghcr.io/mend/renovate-ee-server, docker<15.5.0GitHub
  • mend/renovate-ee-worker, docker<15.5.0GitHub
  • docker.io/mend/renovate-ee-worker, docker<15.5.0GitHub
  • ghcr.io/mend/renovate-ee-worker, docker<15.5.0GitHub
  • ghcr.io/mend/charts/mend-renovate-ce, docker<15.5.0GitHub
  • mend-renovate-ce, docker<15.5.0GitHub
  • ghcr.io/mend/charts/mend-renovate-enterprise-edition, docker<10.5.0GitHub
  • mend-renovate-enterprise-edition, docker<10.5.0GitHub

References 3