Executive brief
Renovate is a tool that automatically updates project dependencies. It includes a safety feature called "Minimum Release Age" that prevents pulling in newly published (and potentially malicious) dependencies until they've been available for a certain period. This vulnerability allows digest-type updates (such as Docker images and GitHub Actions) to bypass this safety check, allowing a malicious dependency to trigger CI workflows before the configured waiting period has passed.
Technical details
The vulnerability is an authorization bypass (CWE-863) in the internal minimumReleaseAge validation logic. Renovate fails to apply stability-age checks to digest-type updates (GitHub Actions pinned via commit SHA with floating tags, Docker images, Go modules, and NuGet packages), even when minimumReleaseAge is configured. An attacker can publish a malicious digest and Renovate will immediately create a PR with only a pending renovate/stability-days check, allowing CI to run before the minimum release age has elapsed. This requires the repository to have minimumReleaseAge configured and dependencies with updateType=digest. The issue is fixed in Renovate 44.3.1, Mend Renovate CE/EE 15.4.0, and Mend Enterprise Edition Helm chart 10.4.0.
Affected products
- Renovate Renovate before 44.3.1
- Mend Renovate CE before 15.4.0
- Mend Renovate EE before 15.4.0
- Mend mend-renovate-ce Helm chart before 15.4.0
- Mend mend-renovate-enterprise-edition Helm chart before 10.4.0
Timeline
- 2026-08-27: disclosed
- 2026-09-10: advisory
- 2026-09-10: patched: Renovate 44.3.1, Mend Renovate CE/EE 15.4.0, Mend Enterprise Edition Helm chart 10.4.0