CVE-2026-110865
Full vulnerability record from the local CVENow database.
Description
Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repository users to evade the allowedHeaders restriction by placing hostRules headers inside shared presets. Attackers can supply internal or externally sourced presets with unvalidated hostRules[].headers to inject custom HTTP headers into requests Renovate sends to other hosts.
Severity
HIGH
CVSS score
7.1
(v4.0)
Vulnerability status
Awaiting Analysis
Source identifier
Published
2026-10-14 23:17:28.110000
Last modified
2026-10-26 16:17:11.850000
View original CVE JSON
{
"id": "CVE-2026-110865",
"sourceIdentifier": "[email protected]",
"published": "2026-10-14T23:17:28.110",
"lastModified": "2026-10-26T16:17:11.850",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repository users to evade the allowedHeaders restriction by placing hostRules headers inside shared presets. Attackers can supply internal or externally sourced presets with unvalidated hostRules[].headers to inject custom HTTP headers into requests Renovate sends to other hosts."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "renovatebot",
"product": "renovate",
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/renovate",
"versions": [
{
"version": "0",
"lessThan": "44.60.1",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "mend",
"product": "renovate-ce",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"lessThan": "15.5.0",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "mend",
"product": "renovate-ee-server",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"lessThan": "15.5.0",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "mend",
"product": "renovate-ee-worker",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"lessThan": "15.5.0",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "mend",
"product": "mend-renovate-ce helm chart",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"lessThan": "15.5.0",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "mend",
"product": "mend-renovate-enterprise-edition helm chart",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"lessThan": "10.5.0",
"versionType": "semver",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "LOW",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 1.8,
"impactScore": 4.7
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-10-26T15:22:04.979008Z",
"id": "CVE-2026-110865",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-424"
}
]
}
],
"references": [
{
"url": "https://github.com/renovatebot/renovate/security/advisories/GHSA-6j6f-fh7w-vvjr",
"source": "[email protected]"
},
{
"url": "https://www.vulncheck.com/advisories/renovate-before-44.60.1-http-header-allowlist-bypass-via-shared-presets",
"source": "[email protected]"
}
]
}