CVE-2026-110865 in Renovate
Summary
by MITRE • 10/15/2026
Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repository users to evade the allowedHeaders restriction by placing hostRules headers inside shared presets. Attackers can supply internal or externally sourced presets with unvalidated hostRules[].headers to inject custom HTTP headers into requests Renovate sends to other hosts.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in versions of Renovate prior to 44.60.1 represents a significant security flaw within the configuration processing logic, specifically concerning how allowed headers are validated against incoming host rules. This issue stems from an allowlist bypass mechanism that permits repository users to circumvent restrictions designed to limit which HTTP headers can be injected into outbound requests. The core of the problem lies in the handling of shared presets, where attackers or malicious actors can supply internal or externally sourced configuration files containing unvalidated hostRules[].headers entries. By exploiting this flaw, it becomes possible to inject custom HTTP headers into any request that Renovate initiates toward other hosts, effectively bypassing the intended security controls meant to restrict header injection capabilities.
From a technical perspective, the vulnerability arises because the validation logic for allowedHeaders does not adequately account for configurations nested within shared presets. When Renovate processes these presets, it fails to recursively apply or enforce the allowlist constraints on headers defined in hostRules sections contained therein. This oversight allows an attacker who has write access to repository configuration files, including those that are shared across multiple projects via presets, to define arbitrary HTTP headers. These headers can then be appended to requests made by Renovate during its normal operation, such as when fetching package metadata or interacting with upstream registries and dependency sources. The lack of strict validation at this level means that the security boundary intended to prevent header injection is effectively neutralized for any configuration loaded through the preset mechanism.
The operational impact of this vulnerability is substantial, particularly in environments where Renovate is used extensively across multiple repositories with shared configurations. An attacker who can influence or supply these presets could manipulate HTTP requests sent by the tool, potentially leading to security issues such as request smuggling, header injection attacks against internal services, or even credential leakage if sensitive headers are inadvertently included. This capability undermines the principle of least privilege and trust boundaries within CI/CD pipelines that rely on Renovate for dependency management. It also poses a risk to supply chain integrity, as malicious actors could potentially alter requests in transit to redirect traffic or exfiltrate data through custom header fields that might be logged or processed by downstream services.
This vulnerability aligns with CWE-94, which describes Improper Control of Generation of Code (Code Injection), specifically focusing on the injection of unwanted elements into a command or request structure via unvalidated input. In terms of attack tactics, it relates to MITRE ATT&CK techniques involving Command and Scripting Interpreter abuse or potentially T1059 if used in conjunction with other exploits for code execution through manipulated service interactions. The ability to inject headers is particularly dangerous because HTTP headers are often trusted by backend services without sufficient scrutiny, making them a prime vector for various application-layer attacks including cross-site scripting precursors, server-side request forgery facilitation, or authentication bypasses depending on the specific header and target system behavior.
To mitigate this risk, organizations must immediately upgrade Renovate to version 44.60.1 or later, where the allowlist validation logic has been corrected to properly enforce restrictions on headers within shared presets. In addition to upgrading, it is critical to audit existing configuration files for any instances of hostRules containing header definitions that were added prior to the patch. Access controls should be tightened around repository configurations and preset sharing mechanisms to ensure that only trusted users can modify these settings. Furthermore, implementing strict input validation on all external sources feeding into Renovate’s configuration pipeline will help prevent similar bypasses in future versions or related tools. Regular security reviews of CI/CD pipelines and dependency management workflows are essential to maintain visibility over how such configurations impact the broader infrastructure and to detect any unauthorized changes that might indicate exploitation attempts.