# CVE-2026-110867: Renovate environment variable allowlist bypass in shared presets

Source: https://junglewise.ai/threats/cve-2026-110867-renovate-before-44-60-1-contains-an-allowlist-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-14. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-110867 · Severity: high · CVSS 8.5 · Published 2026-10-14

Renovate is a dependency management automation tool used by development teams to keep software packages up-to-date. A vulnerability in Renovate before version 44.60.1 allows attackers to bypass security restrictions on environment variables by inserting dangerous settings into shared configuration presets. An attacker controlling an external preset can manipulate critical variables like PATH or LD_PRELOAD, potentially executing arbitrary code when Renovate runs on self-hosted instances.

Technologies: [mend-renovate-ce Helm Chart](https://junglewise.ai/threats/technologies/mend-renovate-ce-helm-chart), [mend-renovate-enterprise-edition Helm Chart](https://junglewise.ai/threats/technologies/mend-renovate-enterprise-edition-helm-chart), [Mend Renovate-Ce](https://junglewise.ai/threats/technologies/renovate-ce), [Renovate](https://junglewise.ai/threats/technologies/renovate-renovate). Vendors: [Mend](https://junglewise.ai/threats/vendors/mend), [Renovate](https://junglewise.ai/threats/vendors/renovate).

## Quick answers

**Is CVE-2026-110867 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-110867 being exploited in the wild.

**How severe is CVE-2026-110867?** High severity, with a CVSS score of 8.5, published 14 October 2026.

**Which products and versions are affected?** mend-renovate-ce Helm Chart before 15.5.0; mend-renovate-enterprise-edition Helm Chart before 10.5.0; Mend Renovate Enterprise Edition Server before 15.5.0; Mend Renovate Enterprise Edition Worker before 15.5.0; and 2 more.

**Is there a fix for CVE-2026-110867?** Yes: fixed in Renovate 44.60.1; Renovate CE 15.5.0; Renovate Enterprise Edition Server 15.5.0; Renovate Enterprise Edition Worker 15.5.0; Mend Renovate CE Helm Chart 15.5.0; Mend Renovate Enterprise Edition Helm Chart 10.5.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-110867 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-110867?** Check whether you run mend-renovate-ce Helm Chart, mend-renovate-enterprise-edition Helm Chart, Mend Renovate Enterprise Edition Server or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Renovate 44.60.1; Renovate CE 15.5.0; Renovate Enterprise Edition Server 15.5.0; Renovate Enterprise Edition Worker 15.5.0; Mend Renovate CE Helm Chart 15.5.0; Mend Renovate Enterprise Edition Helm Chart 10.5.0

## Technical details

The vulnerability is an authorization bypass (CWE-863) in Renovate's environment variable allowlist enforcement. An administrator can restrict which environment variables repositories are allowed to set via the allowedEnv configuration, but an attacker can circumvent this by placing env settings inside a shared preset that gets imported. Since presets can be externally sourced, a malicious preset from the public internet could override restricted variables (PATH, LD_PRELOAD, NODE_OPTIONS, GIT_SSL_CAINFO) in child processes with low privileges required and no user interaction needed.

## Affected products

- Renovate Renovate before 44.60.1
- Mend Renovate CE before 15.5.0
- Mend Renovate Enterprise Edition Server before 15.5.0
- Mend Renovate Enterprise Edition Worker before 15.5.0
- Mend Mend Renovate CE Helm Chart before 15.5.0
- Mend Mend Renovate Enterprise Edition Helm Chart before 10.5.0

## Timeline

- 2026-09-29: disclosed
- 2026-10-14: advisory

## References

- [https://github.com/renovatebot/renovate/security/advisories/GHSA-6873-xr44-22vm](https://github.com/renovatebot/renovate/security/advisories/GHSA-6873-xr44-22vm)
- [https://www.vulncheck.com/advisories/renovate-before-44.60.1-allowedenv-allowlist-bypass-via-shared-preset](https://www.vulncheck.com/advisories/renovate-before-44.60.1-allowedenv-allowlist-bypass-via-shared-preset)

## Related threats

- [Renovate server-side request forgery in HTTP presets](https://junglewise.ai/threats/cve-2026-110868-renovate-before-44-79-0-contains-a-server-side-request-forgery)
- [Renovate protection mechanism bypass in minimumReleaseAge checks](https://junglewise.ai/threats/cve-2026-110866-renovate-before-44-61-3-contains-a-protection-mechanism-bypass)
- [Renovate HTTP header allowlist bypass in shared presets](https://junglewise.ai/threats/cve-2026-110865-renovate-before-44-60-1-contains-an-allowlist-bypass)
- [Renovate command injection in Maven Wrapper manager](https://junglewise.ai/threats/cve-2026-88889-renovate-command-injection-in-maven-wrapper-manager)
- [Renovate Mix manager command injection via unescaped organization parameter](https://junglewise.ai/threats/cve-2026-88888-renovate-mix-manager-command-injection-via-unescaped-organization)