CVE-2026-110866: Renovate before 44.61.3 minimumReleaseAge Bypass via PR Rebase Request
Renovate before 44.61.3 contains a protection mechanism bypass vulnerability that allows minimumReleaseAge checks to be skipped when a user requests a PR rebase via the rebase/retry checkbox. Attackers who publish a malicious dependency version can have it pushed into the PR and run in CI before the required release age elapses.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Renovateto a version that resolves this vulnerability.Fixed in 44.61.3
Event History
Frequently Asked Questions
Who is exposed to this bypass?
Organizations using Mend Renovate versions before 44.61.3 with minimumReleaseAge protections enabled are exposed. The impact is greatest where Renovate pull requests are allowed to trigger CI that installs or executes updated dependencies.
What does an attacker need to exploit it?
An attacker needs to publish a malicious dependency version that Renovate can select for an update. A user must then request a pull request rebase using the rebase/retry checkbox, allowing the release-age check to be skipped.
Does exploitation require authentication or user interaction?
The vulnerability is remotely reachable and does not require attacker privileges in Renovate. However, exploitation requires user interaction because someone must request the PR rebase or retry through the checkbox.
How can teams determine whether they may already be affected?
Review Renovate version information and identify deployments earlier than 44.61.3. Also review Renovate PR activity for rebase or retry requests that caused dependency versions to be updated and run in CI before their configured minimum release age elapsed.