CVE-2026-110865: Renovate before 44.60.1 HTTP Header Allowlist Bypass via Shared Presets
Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repository users to evade the allowedHeaders restriction by placing hostRules headers inside shared presets. Attackers can supply internal or externally sourced presets with unvalidated hostRules[].headers to inject custom HTTP headers into requests Renovate sends to other hosts.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Renovateto a version that resolves this vulnerability.Fixed in 44.60.1
Event History
Frequently Asked Questions
Which Renovate deployments are exposed?
Deployments running a Renovate version before 44.60.1 are affected if repository users can supply shared presets, including internally hosted or externally sourced presets, containing hostRules headers.
What access does an attacker need to exploit this?
An attacker needs low-level privileges as a repository user and must be able to provide a shared preset that Renovate processes. Exploitation does not require user interaction, but the attacker must craft hostRules[].headers values to bypass the configured allowedHeaders restriction.
What is the practical impact of successful exploitation?
An attacker can inject custom HTTP headers into requests Renovate sends to other hosts. The reported impact includes high confidentiality impact and low integrity impact, with the scope changed.
How can I determine whether my configuration is affected?
Check whether Renovate is older than 44.60.1 and whether repositories can reference shared presets from internal or external sources. Review those presets for hostRules entries that define headers, particularly headers that would not be permitted by the allowedHeaders configuration.