CVE-2026-110867

Awaiting Analysis Awaiting Analysis - Queue

Renovate Allowlist Bypass via Shared Preset Environment Variables

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: VulnCheck

Description

Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repositories to set restricted environment variables by placing env inside a shared preset. Attackers controlling an externally sourced preset can override variables like PATH, LD_PRELOAD, NODE_OPTIONS, or GIT_SSL_CAINFO in child processes on self-hosted instances.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110867

EUVD

EUVD-2026-101750

Affected Vendors & Products

Vendor	Product	Version / Range
renovatebot	renovate	0
mend	renovate-ce	0
mend	renovate-ee-server	0
mend	renovate-ee-worker	0
mend	mend-renovate-ce	helm chart 0
mend	mend-renovate-enterprise-edition	helm chart 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

Renovate before 44.60.1 has an allowlist bypass flaw where attackers controlling an externally sourced preset can set restricted environment variables like PATH, LD_PRELOAD, NODE_OPTIONS, or GIT_SSL_CAINFO in child processes on self-hosted instances.

Detection Guidance

To detect this vulnerability, inspect Renovate configuration files for externally sourced presets containing env variables. Check for suspicious environment variable overrides in shared presets. Review child process environment variables on self-hosted instances for unexpected PATH, LD_PRELOAD, NODE_OPTIONS, or GIT_SSL_CAINFO modifications.

Impact Analysis

Attackers could manipulate environment variables to execute arbitrary code, escalate privileges, or access sensitive data on systems running vulnerable Renovate instances.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR (data protection) and HIPAA (health data security) requirements for access controls and integrity.

Mitigation Strategies

Upgrade Renovate to version 44.60.1 or later to address the allowlist bypass vulnerability. Review and restrict environment variable usage in shared presets to prevent unauthorized overrides of critical variables like PATH or LD_PRELOAD.

Hi! I’m here to help you understand CVE-2026-110867. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70