{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/renovate--44.60.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:mend:renovate:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.5,"id":"CVE-2026-110867"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Renovate (\u003c 44.60.1)"],"_cs_severities":["high"],"_cs_tags":["supply-chain","ci-cd","code-execution"],"_cs_type":"advisory","_cs_vendors":["Mend"],"content_html":"\u003cp\u003eRenovate versions prior to 44.60.1 contain an allowlist bypass vulnerability within its configuration preset system. An attacker who controls an externally sourced preset can override restricted environment variables such as PATH, LD_PRELOAD, NODE_OPTIONS, or GIT_SSL_CAINFO. This vulnerability is particularly dangerous for self-hosted Renovate instances where the software executes child processes to perform dependency management and dependency updates. By injecting malicious configuration, an attacker can manipulate the execution environment of these child processes, resulting in arbitrary code execution on the underlying host. The flaw arises from improper validation of preset contents, allowing arbitrary environment variable injection that bypasses existing security restrictions designed to prevent such modifications.\u003c/p\u003e\n","date_modified":"2026-10-15T00:34:27Z","date_published":"2026-10-15T00:34:27Z","id":"https://feed.craftedsignal.io/briefs/2026-10-renovate-bypass/","summary":"An allowlist bypass in Renovate versions prior to 44.60.1 enables attackers to inject restricted environment variables via malicious configuration presets, leading to arbitrary code execution in child processes.","title":"Renovate Configuration Preset Allowlist Bypass","url":"https://feed.craftedsignal.io/briefs/2026-10-renovate-bypass/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:renovate:renovate:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.1,"id":"CVE-2026-110865"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Renovate (\u003c 44.60.1)"],"_cs_severities":["high"],"_cs_tags":["vulnerability","supply-chain","renovate","cve-2026-110865"],"_cs_type":"advisory","_cs_vendors":["Renovate"],"content_html":"\u003cp\u003eRenovate before version 44.60.1 contains a vulnerability that allows repository users to evade 'allowedHeaders' restrictions. By leveraging the way Renovate handles shared presets, an attacker can supply internal or externally sourced presets containing unvalidated 'hostRules[].headers'. When processed, these presets allow the injection of custom HTTP headers into requests that the Renovate application sends to external hosts. This vulnerability is significant as it permits the redirection of sensitive authentication tokens or credentials to attacker-controlled infrastructure, or the manipulation of requests to downstream services, potentially leading to unauthorized data exposure. Organizations utilizing Renovate for dependency management should prioritize upgrading to version 44.60.1 or later to mitigate this risk.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows repository users to bypass security controls by injecting arbitrary headers into outbound requests made by the Renovate service. This can lead to unauthorized data exposure, potential credential theft via header manipulation, and the ability to influence requests directed at third-party hosts within the supply chain infrastructure.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade all instances of Renovate to version 44.60.1 or later immediately.\u003c/li\u003e\n\u003cli\u003eAudit existing shared presets for the presence of unauthorized or suspicious 'hostRules' blocks, specifically inspecting the 'headers' property for non-standard or external destination domains.\u003c/li\u003e\n\u003cli\u003eImplement stricter egress filtering for the Renovate service to prevent connections to unauthorized external hosts if header injection is attempted.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-15T00:34:21Z","date_published":"2026-10-15T00:34:21Z","id":"https://feed.craftedsignal.io/briefs/2026-10-renovate-allowlist-bypass/","summary":"Renovate versions prior to 44.60.1 are vulnerable to an allowlist bypass that permits repository users to inject arbitrary HTTP headers via malicious shared presets.","title":"Renovate Allowlist Bypass via Shared Presets","url":"https://feed.craftedsignal.io/briefs/2026-10-renovate-allowlist-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Renovate (\u003c 44.60.1)","version":"https://jsonfeed.org/version/1.1"}