{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-110865/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:renovate:renovate:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.1,"id":"CVE-2026-110865"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Renovate (\u003c 44.60.1)"],"_cs_severities":["high"],"_cs_tags":["vulnerability","supply-chain","renovate","cve-2026-110865"],"_cs_type":"advisory","_cs_vendors":["Renovate"],"content_html":"\u003cp\u003eRenovate before version 44.60.1 contains a vulnerability that allows repository users to evade 'allowedHeaders' restrictions. By leveraging the way Renovate handles shared presets, an attacker can supply internal or externally sourced presets containing unvalidated 'hostRules[].headers'. When processed, these presets allow the injection of custom HTTP headers into requests that the Renovate application sends to external hosts. This vulnerability is significant as it permits the redirection of sensitive authentication tokens or credentials to attacker-controlled infrastructure, or the manipulation of requests to downstream services, potentially leading to unauthorized data exposure. Organizations utilizing Renovate for dependency management should prioritize upgrading to version 44.60.1 or later to mitigate this risk.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows repository users to bypass security controls by injecting arbitrary headers into outbound requests made by the Renovate service. This can lead to unauthorized data exposure, potential credential theft via header manipulation, and the ability to influence requests directed at third-party hosts within the supply chain infrastructure.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade all instances of Renovate to version 44.60.1 or later immediately.\u003c/li\u003e\n\u003cli\u003eAudit existing shared presets for the presence of unauthorized or suspicious 'hostRules' blocks, specifically inspecting the 'headers' property for non-standard or external destination domains.\u003c/li\u003e\n\u003cli\u003eImplement stricter egress filtering for the Renovate service to prevent connections to unauthorized external hosts if header injection is attempted.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-15T00:34:21Z","date_published":"2026-10-15T00:34:21Z","id":"https://feed.craftedsignal.io/briefs/2026-10-renovate-allowlist-bypass/","summary":"Renovate versions prior to 44.60.1 are vulnerable to an allowlist bypass that permits repository users to inject arbitrary HTTP headers via malicious shared presets.","title":"Renovate Allowlist Bypass via Shared Presets","url":"https://feed.craftedsignal.io/briefs/2026-10-renovate-allowlist-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-110865","version":"https://jsonfeed.org/version/1.1"}