CVE-2026-110865: Improper Protection of Alternate Path in renovatebot renovate
Description
CVE-2026-110865 is a high-severity vulnerability in renovatebot's renovate tool before version 44.60.1. It allows repository users to bypass the allowedHeaders restriction by embedding hostRules headers inside shared presets. This enables attackers to inject custom HTTP headers into requests sent by Renovate to other hosts.
CVSS v4.0
Score 7.1high
Affected software
renovatebot
renovate
mend
renovate-ce
mend
renovate-ee-server
mend
renovate-ee-worker
mend
mend-renovate-ce helm chart
mend
mend-renovate-enterprise-edition helm chart
pkg:npm/renovatebot/renovateRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Renovate versions prior to 44.60.1 contain an allowlist bypass vulnerability that permits repository users to circumvent the allowedHeaders restriction. The vulnerability arises because hostRules headers placed inside shared presets are not properly validated. Attackers can supply internal or external presets with unvalidated hostRules[].headers, resulting in the injection of arbitrary HTTP headers into requests that Renovate sends to other hosts.
Potential Impact
An attacker with repository access can inject custom HTTP headers into outbound requests made by Renovate, potentially leading to unauthorized actions or information disclosure depending on the headers injected and the target hosts. The vulnerability requires low privileges (repository user) but has a high complexity due to the need to supply crafted presets. There is no indication of known exploits in the wild.
Mitigation Recommendations
A fix is available in renovate version 44.60.1. Users should upgrade to version 44.60.1 or later to remediate this vulnerability. No additional mitigation steps are indicated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-14T22:18:33.239Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad00a672cdf04f656ba0301
Added to database: 10/14/2026, 23:04:07 UTC
Last enriched: 10/14/2026, 23:18:24 UTC
Last updated: 10/14/2026, 23:20:01 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.