CVE-2026-110866: Renovate protection mechanism bypass in minimumReleaseAge checks

CVE-2026-110866 · Severity: medium · CVSS 4.7 · Published 2026-10-14

Renovate is a dependency update automation tool that manages software package upgrades in code repositories. A protection mechanism called minimumReleaseAge prevents newly released packages from being automatically updated until they have aged for a specified time, reducing the risk of deploying immature or malicious code. Attackers can bypass this protection by tricking users into rebasing pull requests, causing malicious package versions to be injected into builds and CI/CD pipelines before the safety period elapses.

Technologies: Mend Renovate-Ce, Mend Renovate-Ee-Server, Mend Renovate-Ee-Worker, Renovate. Vendors: Mend, Renovate.

Quick answers

Is CVE-2026-110866 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-110866 being exploited in the wild.
How severe is CVE-2026-110866?
Medium severity, with a CVSS score of 4.7, published 14 October 2026.
Which products and versions are affected?
Mend Renovate-Ce before 15.5.0; Mend Renovate-Ee-Server before 15.5.0; Mend Renovate-Ee-Worker before 15.5.0; Renovate before 44.61.3.
Is there a fix for CVE-2026-110866?
Yes: fixed in Renovate 44.61.3; Mend renovate-ce, renovate-ee-server, renovate-ee-worker 15.5.0; Mend renovate-enterprise-edition Helm chart 10.5.0. Until then: Modify the PR body template to remove the checkbox actions and/or set dependencyDashboard=true to disable the rebase/retry checkbox interaction. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-110866 attacked?
It is attacked over the network.
Am I affected by CVE-2026-110866?
Check whether you run Mend Renovate-Ce, Mend Renovate-Ee-Server, Mend Renovate-Ee-Worker or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: Renovate 44.61.3; Mend renovate-ce, renovate-ee-server, renovate-ee-worker 15.5.0; Mend renovate-enterprise-edition Helm chart 10.5.0

Modify the PR body template to remove the checkbox actions and/or set dependencyDashboard=true to disable the rebase/retry checkbox interaction.

Technical details

The vulnerability is a protection mechanism bypass (CWE-693) in the minimumReleaseAge check implementation. When a user clicks the rebase/retry checkbox on a Renovate pull request, the tool incorrectly skips its own safety checks and updates to the latest available package version regardless of release age. The attack requires user interaction (write access to click the checkbox) and network-based triggering, and allows an attacker to push unvetted package versions into CI/CD pipelines for execution.

Affected products

  • Renovate Renovate before 44.61.3
  • Mend renovate-ce before 15.5.0
  • Mend renovate-ee-server before 15.5.0
  • Mend renovate-ee-worker before 15.5.0

Timeline

  • 2026-09-29: disclosed
  • 2026-10-14: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.