CVE-2026-110866

Awaiting Analysis Awaiting Analysis - Queue

Renovate Protection Bypass via PR Rebase Checkbox

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: VulnCheck

Description

Renovate before 44.61.3 contains a protection mechanism bypass vulnerability that allows minimumReleaseAge checks to be skipped when a user requests a PR rebase via the rebase/retry checkbox. Attackers who publish a malicious dependency version can have it pushed into the PR and run in CI before the required release age elapses.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110866

EUVD

EUVD-2026-101749

Affected Vendors & Products

Vendor	Product	Version / Range
renovatebot	renovate	0
mend	renovate-ce	0
mend	renovate-ee-server	0
mend	renovate-ee-worker	0
mend	mend-renovate-ce	helm chart 0
mend	mend-renovate-enterprise-edition	helm chart 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-693	The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Attack-Flow Graph

Executive Summary

Renovate before version 44.61.3 has a vulnerability where attackers can bypass a security check called minimumReleaseAge. This check normally prevents new dependency versions from being used too soon. By tricking users into clicking a rebase/retry checkbox, attackers can push malicious dependency versions into pull requests and run them in CI before the required waiting period ends.

Impact Analysis

If you use Renovate, attackers could exploit this to inject malicious code into your projects. This could lead to unauthorized code execution, data breaches, or compromised CI/CD pipelines. The impact depends on your environment and how Renovate is configured in your workflow.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it is a software mechanism bypass issue in Renovate. However, if exploited, it could lead to unauthorized dependency updates in CI/CD pipelines, potentially violating compliance requirements for software supply chain integrity and change management.

Mitigation Strategies

Upgrade Renovate to version 44.61.3 or later to address the bypass vulnerability in minimumReleaseAge checks.

Hi! I’m here to help you understand CVE-2026-110866. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70