CVE-2026-110865

Awaiting Analysis Awaiting Analysis - Queue

Renovate Allowlist Bypass via Shared Presets Headers

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: VulnCheck

Description

Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repository users to evade the allowedHeaders restriction by placing hostRules headers inside shared presets. Attackers can supply internal or externally sourced presets with unvalidated hostRules[].headers to inject custom HTTP headers into requests Renovate sends to other hosts.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110865

EUVD

EUVD-2026-101748

Affected Vendors & Products

Vendor	Product	Version / Range
renovatebot	renovate	0
mend	renovate-ce	0
mend	renovate-ee-server	0
mend	renovate-ee-worker	0
mend	mend-renovate-ce	helm chart 0
mend	mend-renovate-enterprise-edition	helm chart 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-424	The product does not sufficiently protect all possible paths that a user can take to access restricted functionality or resources.

Attack-Flow Graph

Executive Summary

Renovate before 44.60.1 has an allowlist bypass flaw where repository users can evade the allowedHeaders restriction by inserting hostRules headers into shared presets. Attackers can use unvalidated hostRules[].headers in internal or external presets to inject custom HTTP headers into requests Renovate sends to other hosts.

Detection Guidance

To detect this vulnerability, inspect Renovate configuration files for shared presets containing hostRules headers. Check for unvalidated headers in requests by monitoring HTTP traffic for unexpected custom headers. Review Renovate logs for outgoing requests with modified headers.

Impact Analysis

This vulnerability could allow unauthorized HTTP header injection, potentially leading to data exfiltration, request manipulation, or bypassing security controls. Attackers might access sensitive information or perform actions on behalf of users if exploited.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized HTTP header injection. Attackers could use this to exfiltrate sensitive data or bypass security controls, which may violate data protection requirements under these regulations.

Mitigation Strategies

Upgrade Renovate to version 44.60.1 or later to address the allowlist bypass vulnerability. Review and validate all shared presets and hostRules configurations to ensure no unvalidated headers are present.

Hi! I’m here to help you understand CVE-2026-110865. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70