CVE-2026-110868

Awaiting Analysis Awaiting Analysis - Queue

Server-Side Request Forgery in Renovate Before 44.79.0

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: VulnCheck

Description

Renovate before 44.79.0 contains a server-side request forgery vulnerability that allows users to make the shared HTTP client request arbitrary internal URLs via extends presets or customDatasources. Attackers can point a preset at an instance metadata service endpoint to obtain AWS credentials or leak sensitive information through Renovate logs.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110868

EUVD

EUVD-2026-101751

Affected Vendors & Products

Vendor	Product	Version / Range
renovatebot	renovate	0
mend	renovate-ce	0
mend	renovate-ee-server	0
mend	renovate-ee-worker	0
mend	mend-renovate-ce	helm chart 0
mend	mend-renovate-enterprise-edition	helm chart 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

Renovate before version 44.79.0 has a server-side request forgery (SSRF) vulnerability. This flaw allows users to manipulate shared HTTP client requests to access arbitrary internal URLs through extends presets or customDatasources. Attackers could exploit this to target internal services like instance metadata endpoints to steal AWS credentials or expose sensitive data via Renovate logs.

Detection Guidance

To detect CVE-2026-110868, monitor Renovate logs for unusual outbound requests to internal or metadata service endpoints. Check for requests to AWS instance metadata service URLs like 169.254.169.254 or similar internal services. Review network traffic for unexpected SSRF patterns originating from Renovate processes.

Impact Analysis

This vulnerability could lead to unauthorized access to internal systems, theft of credentials (e.g., AWS keys), or leakage of sensitive information stored in logs. Organizations using Renovate in their CI/CD pipelines or internal networks may face data breaches or compromised cloud environments if attackers exploit this flaw.

Compliance Impact

This vulnerability could violate compliance requirements under GDPR (data protection) or HIPAA (healthcare data) by enabling unauthorized access to sensitive data or credentials. Organizations may face regulatory penalties, reputational damage, or legal consequences if exploited, especially if personal or health data is exposed.

Mitigation Strategies

Upgrade Renovate to version 44.79.0 or later to address the SSRF vulnerability. Review and restrict network access to internal services to prevent unauthorized requests from Renovate. Monitor logs for suspicious activity related to internal URL access attempts.

Hi! I’m here to help you understand CVE-2026-110868. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70