CVE-2026-110868: Renovate server-side request forgery in HTTP presets

CVE-2026-110868 · Severity: high · CVSS 8.5 · Published 2026-10-14

Renovate is a dependency update automation tool used by development teams to keep project libraries current. A server-side request forgery vulnerability allows attackers to make Renovate fetch arbitrary internal URLs through malicious preset configurations or custom data sources, potentially exposing AWS credentials, cloud metadata, or other sensitive information. An attacker who can contribute a malicious configuration or preset could extract credentials from the hosting environment.

Technologies: Mend Renovate-Ce, Mend Renovate-Ee-Server, Mend Renovate-Ee-Worker, Renovate. Vendors: Mend, Renovate.

Quick answers

Is CVE-2026-110868 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-110868 being exploited in the wild.
How severe is CVE-2026-110868?
High severity, with a CVSS score of 8.5, published 14 October 2026.
Which products and versions are affected?
Mend Renovate-Ce before 15.6.0; Mend Renovate-Ee-Server before 15.6.0; Mend Renovate-Ee-Worker before 15.6.0; Renovate before 44.79.0.
Is there a fix for CVE-2026-110868?
Yes: fixed in Renovate 44.79.0; Renovate CE 15.6.0; Renovate EE Server 15.6.0; Renovate EE Worker 15.6.0. Until then: For self-hosted instances with Platform resolved on a private IP, upgrade to Renovate 44.118.1 or configure global `hostRules[].allowInternal` settings to restrict internal network access via Renovate's configuration.</anigation> <parameter name="timeline">[ { "kind": "disclosed", "at": "2026-09-29" }, { "kind": "advisory", "at": "2026-10-14" } ] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-110868 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-110868?
Check whether you run Mend Renovate-Ce, Mend Renovate-Ee-Server, Mend Renovate-Ee-Worker or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: Renovate 44.79.0; Renovate CE 15.6.0; Renovate EE Server 15.6.0; Renovate EE Worker 15.6.0

For self-hosted instances with Platform resolved on a private IP, upgrade to Renovate 44.118.1 or configure global `hostRules[].allowInternal` settings to restrict internal network access via Renovate's configuration.</anigation> <parameter name="timeline">[ { "kind": "disclosed", "at": "2026-09-29" }, { "kind": "advisory", "at": "2026-10-14" } ]

Technical details

The vulnerability exists in Renovate's shared HTTP client used for fetching presets and custom datasources. An attacker can craft a malicious configuration pointing to internal IP addresses (such as AWS EC2 metadata service at 169.254.169.254) via the `extends` array or `customDatasources`, and Renovate will make credentialed requests to those URLs. The response or error details may be leaked in Renovate logs, enabling credential theft or information disclosure.

Affected products

  • Renovate Renovate before 44.79.0
  • Mend Renovate CE before 15.6.0
  • Mend Renovate EE Server before 15.6.0
  • Mend Renovate EE Worker before 15.6.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.