CVE-2026-110867: Renovate before 44.60.1 allowedEnv Allowlist Bypass via Shared Preset
Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repositories to set restricted environment variables by placing env inside a shared preset. Attackers controlling an externally sourced preset can override variables like PATH, LDPRELOAD, NODEOPTIONS, or GITSSLCAINFO in child processes on self-hosted instances.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Renovateto a version that resolves this vulnerability.Fixed in 44.60.1
Event History
Frequently Asked Questions
Which deployments are most exposed?
Self-hosted Renovate instances are exposed when they process repositories that use externally sourced shared presets controlled by an attacker. The impact occurs in child processes where the preset can override restricted environment variables.
What does an attacker need to exploit this?
An attacker needs control of an externally sourced shared preset used by a repository processed by Renovate. Exploitation also requires the ability to set the preset's env configuration; no user interaction is required, but the attack complexity is rated high and low privileges are required.
Are default configurations affected?
The provided information identifies the vulnerable condition as placing env inside a shared preset. It does not establish that a default Renovate configuration uses externally sourced shared presets or is affected without that configuration.
What should teams do if they cannot immediately upgrade?
Avoid or tightly control externally sourced shared presets, especially presets that can define env values. Review preset sources and prevent untrusted presets from setting variables such as PATH, LD_PRELOAD, NODE_OPTIONS, and GIT_SSL_CAINFO.
How can teams determine whether they may be affected?
Check whether Renovate is older than 44.60.1 and whether processed repositories reference externally sourced shared presets. Inspect those presets for env entries, particularly values that override PATH, LD_PRELOAD, NODE_OPTIONS, GIT_SSL_CAINFO, or other restricted environment variables.