What’s Vulnerable › Vulnerabilities

CVE-2026-110865: Renovate before 44.60.1 HTTP Header Allowlist Bypass via Shared Presets

• Severity: high (CVSS 7.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-14 · updated 2026-10-26
• Weakness: CWE-424

Description

Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repository users to evade the allowedHeaders restriction by placing hostRules headers inside shared presets. Attackers can supply internal or externally sourced presets with unvalidated hostRules[].headers to inject custom HTTP headers into requests Renovate sends to other hosts.

Affected products

• mend-renovate-ce helm chart: before 15.5.0 — fixed in 15.5.0
• mend-renovate-enterprise-edition helm chart: before 10.5.0 — fixed in 10.5.0
• mend renovate-ce: before 15.5.0 — fixed in 15.5.0
• mend renovate-ee-server: before 15.5.0 — fixed in 15.5.0
• mend renovate-ee-worker: before 15.5.0 — fixed in 15.5.0
• renovatebot renovate: before 44.60.1 — fixed in 44.60.1

How to fix

Upgrade to a fixed version: mend-renovate-ce helm chart 15.5.0; mend-renovate-enterprise-edition helm chart 10.5.0; mend renovate-ce 15.5.0; mend renovate-ee-server 15.5.0; mend renovate-ee-worker 15.5.0; renovatebot renovate 44.60.1. Check the vendor advisory for mitigations.

References

• https://github.com/renovatebot/renovate/security/advisories/GHSA-6j6f-fh7w-vvjr
• https://www.vulncheck.com/advisories/renovate-before-44.60.1-http-header-allowlist-bypass-via-shared-presets

Get alerted when CVE-2026-110865 or the next vulnerability affects your stack