← Back to CVE Explorer

CVE-2026-110866

Full vulnerability record from the local CVENow database.

Description

Renovate before 44.61.3 contains a protection mechanism bypass vulnerability that allows minimumReleaseAge checks to be skipped when a user requests a PR rebase via the rebase/retry checkbox. Attackers who publish a malicious dependency version can have it pushed into the PR and run in CI before the required release age elapses.

Severity
MEDIUM
CVSS score
5.3 (v4.0)
Vulnerability status
Awaiting Analysis
Source identifier
[email protected]
Published
2026-10-14 23:17:28.253000
Last modified
2026-10-20 03:17:14.423000
View original CVE JSON 
{
  "id": "CVE-2026-110866",
  "sourceIdentifier": "[email protected]",
  "published": "2026-10-14T23:17:28.253",
  "lastModified": "2026-10-20T03:17:14.423",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Renovate before 44.61.3 contains a protection mechanism bypass vulnerability that allows minimumReleaseAge checks to be skipped when a user requests a PR rebase via the rebase/retry checkbox. Attackers who publish a malicious dependency version can have it pushed into the PR and run in CI before the required release age elapses."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "renovatebot",
          "product": "renovate",
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/renovate",
          "versions": [
            {
              "version": "0",
              "lessThan": "44.61.3",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "mend",
          "product": "renovate-ce",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "lessThan": "15.5.0",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "mend",
          "product": "renovate-ee-server",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "lessThan": "15.5.0",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "mend",
          "product": "renovate-ee-worker",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "lessThan": "15.5.0",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "mend",
          "product": "mend-renovate-ce helm chart",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "lessThan": "15.5.0",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "mend",
          "product": "mend-renovate-enterprise-edition helm chart",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "lessThan": "10.5.0",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "userInteraction": "PASSIVE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "LOW",
          "vulnAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "LOW",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N",
          "baseScore": 4.7,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-10-20T02:27:02.180175Z",
          "id": "CVE-2026-110866",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-693"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/renovatebot/renovate/security/advisories/GHSA-2frq-pm48-6j4h",
      "source": "[email protected]"
    },
    {
      "url": "https://www.vulncheck.com/advisories/renovate-before-44.61.3-minimumreleaseage-bypass-via-pr-rebase-request",
      "source": "[email protected]"
    }
  ]
}