Renovate (< 44.60.1) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/renovate--44.60.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 15 Oct 2026 00:34:27 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgRenovate Configuration Preset Allowlist Bypasshttps://feed.craftedsignal.io/briefs/2026-10-renovate-bypass/Thu, 15 Oct 2026 00:34:27 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-renovate-bypass/An allowlist bypass in Renovate versions prior to 44.60.1 enables attackers to inject restricted environment variables via malicious configuration presets, leading to arbitrary code execution in child processes.<p>Renovate versions prior to 44.60.1 contain an allowlist bypass vulnerability within its configuration preset system. An attacker who controls an externally sourced preset can override restricted environment variables such as PATH, LD_PRELOAD, NODE_OPTIONS, or GIT_SSL_CAINFO. This vulnerability is particularly dangerous for self-hosted Renovate instances where the software executes child processes to perform dependency management and dependency updates. By injecting malicious configuration, an attacker can manipulate the execution environment of these child processes, resulting in arbitrary code execution on the underlying host. The flaw arises from improper validation of preset contents, allowing arbitrary environment variable injection that bypasses existing security restrictions designed to prevent such modifications.</p> highadvisorysupply-chainci-cdcode-executionRenovate Allowlist Bypass via Shared Presetshttps://feed.craftedsignal.io/briefs/2026-10-renovate-allowlist-bypass/Thu, 15 Oct 2026 00:34:21 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-renovate-allowlist-bypass/Renovate versions prior to 44.60.1 are vulnerable to an allowlist bypass that permits repository users to inject arbitrary HTTP headers via malicious shared presets.Renovate before version 44.60.1 contains a vulnerability that allows repository users to evade 'allowedHeaders' restrictions. By leveraging the way Renovate handles shared presets, an attacker can supply internal or externally sourced presets containing unvalidated 'hostRules[].headers'. When processed, these presets allow the injection of custom HTTP headers into requests that the Renovate application sends to external hosts. This vulnerability is significant as it permits the redirection of sensitive authentication tokens or credentials to attacker-controlled infrastructure, or the manipulation of requests to downstream services, potentially leading to unauthorized data exposure. Organizations utilizing Renovate for dependency management should prioritize upgrading to version 44.60.1 or later to mitigate this risk.

Impact

Successful exploitation allows repository users to bypass security controls by injecting arbitrary headers into outbound requests made by the Renovate service. This can lead to unauthorized data exposure, potential credential theft via header manipulation, and the ability to influence requests directed at third-party hosts within the supply chain infrastructure.

Recommendation

  • Upgrade all instances of Renovate to version 44.60.1 or later immediately.
  • Audit existing shared presets for the presence of unauthorized or suspicious 'hostRules' blocks, specifically inspecting the 'headers' property for non-standard or external destination domains.
  • Implement stricter egress filtering for the Renovate service to prevent connections to unauthorized external hosts if header injection is attempted.
]]>highadvisoryvulnerabilitysupply-chainrenovatecve-2026-110865