CVE-2026-110868: Renovate before 44.79.0 SSRF via HTTP Preset URLs and customDatasources
Renovate before 44.79.0 contains a server-side request forgery vulnerability that allows users to make the shared HTTP client request arbitrary internal URLs via extends presets or customDatasources. Attackers can point a preset at an instance metadata service endpoint to obtain AWS credentials or leak sensitive information through Renovate logs.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs the ability to supply or modify Renovate configuration that uses an extends preset URL or customDatasources. Exploitation does not require user interaction and can be performed over the network.
What systems or data are at risk from a successful request?
The affected shared HTTP client can be directed to arbitrary internal URLs. This can expose instance metadata service endpoints, including AWS credentials, and other sensitive information may be leaked through Renovate logs.
Are default Renovate deployments affected?
The provided information identifies HTTP preset URLs and customDatasources as the affected request paths. It does not establish that a deployment without attacker-controlled use of those configuration features is exploitable.
What can be done if an update is not immediately possible?
Restrict who can supply or alter Renovate configuration, particularly extends preset URLs and customDatasources. Prevent Renovate from reaching internal services and instance metadata endpoints where possible, and review Renovate logs for sensitive data exposure.
How can I determine whether my installation is affected?
Installations running Renovate versions before 44.79.0 are affected according to the advisory. Review configuration for extends entries using HTTP preset URLs and for customDatasources, especially where untrusted users can influence their values.