CVE-2026-110865
Renovate before 44.60.1 HTTP Header Allowlist Bypass via Shared Presets
Published Oct 14, 2026 · updated Oct 14, 2026 · renovatebot renovate
Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repository users to evade the allowedHeaders restriction by placing hostRules headers inside shared presets. Attackers can supply internal or externally sourced presets with unvalidated hostRules[].headers to inject custom HTTP headers into requests Renovate sends to other hosts.
Timeline
Detection, updates, and resolution for this record.
Oct 14, 2026 · NIST NVD
Detected
Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repository users to evade the allowedHeaders restriction by placing hostRules headers inside shared presets. Attackers can supply internal or externally sourced presets with unvalidated hostRules[].headers to inject custom HTTP headers into requests Renovate sends to other hosts.
Affected
- vendor mend mend-renovate-ce helm chartversion unspecified
- vendor mend mend-renovate-enterprise-edition helm chartversion unspecified
- vendor mend renovate-ceversion unspecified
- vendor mend renovate-ee-serverversion unspecified
- vendor mend renovate-ee-workerversion unspecified
- vendor renovatebot renovateversion unspecified
Sources
- CVE.orgCVE-2026-110865
Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repository users to evade the allowedHeaders restriction by placing hostRules headers inside shared presets. Attackers can supply internal or externally sourced presets with unvalidated hostRules[].hea
cve.org - NIST NVDCVE-2026-110865
Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repository users to evade the allowedHeaders restriction by placing hostRules headers inside shared presets. Attackers can supply internal or externally sourced presets with unvalidated hostRules[].hea
nvd.nist.gov