CVE-2026-110866 in Renovate
Summary
by MITRE • 10/15/2026
Renovate before 44.61.3 contains a protection mechanism bypass vulnerability that allows minimumReleaseAge checks to be skipped when a user requests a PR rebase via the rebase/retry checkbox. Attackers who publish a malicious dependency version can have it pushed into the PR and run in CI before the required release age elapses.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in Renovate versions prior to 44.61.3 represents a critical flaw in the automated dependency update workflow, specifically targeting the protection mechanisms designed to enforce minimum release ages for dependencies. This security issue arises from an incomplete implementation of validation logic when users interact with the pull request rebase functionality via the rebase or retry checkbox interface. Under normal operational conditions, Renovate is configured to delay merging updates until a specified period has elapsed since the dependency's initial publication. This mechanism serves as a crucial safeguard against integrating unstable, untested, or potentially malicious software artifacts into production codebases by allowing time for community review and stability verification. However, the specific interaction with the rebase command bypasses this temporal validation check entirely, creating a window of opportunity where constraints intended to ensure supply chain integrity are ignored.
From a technical perspective, the flaw lies in how the application state is managed during manual intervention requests. When a user triggers a PR rebase through the graphical interface or associated API endpoints, the system processes the request by updating the base branch and refreshing dependency versions without re-evaluating the minimum release age policy that would normally apply to new updates. This oversight allows any newly resolved version of a dependency, regardless of its publication timestamp relative to the current time, to be included in the updated pull request. Consequently, if an attacker publishes a malicious package with a recent or fabricated date on a public registry such as npm, PyPI, or Maven Central, they can exploit this bypass by influencing the resolution process within Renovate. The system will accept and propagate this version into the CI pipeline without triggering the expected age-based rejection logic.
The operational impact of this vulnerability is significant for organizations relying on automated dependency management to maintain secure software supply chains. By exploiting this flaw, an adversary who controls or compromises a legitimate-looking package can force its inclusion in ongoing development branches through the rebase mechanism. Once integrated into the pull request, the malicious code executes during continuous integration testing and potentially merges into mainline repositories if not manually intercepted. This leads to direct compromise of the build environment, potential injection of backdoors, data exfiltration scripts, or cryptominers into downstream applications. The risk is amplified because automated systems often proceed with deployment based on successful CI checks, meaning the malicious artifact could reach production environments before human reviewers detect the anomaly, especially if the attacker carefully crafts the payload to evade static analysis tools initially.
This vulnerability aligns closely with CWE-20 Improper Input Validation and CWE-841 Improvement of Software Security Controls Bypass, as it involves failing to enforce a security control due to improper handling of user-triggered state changes. In terms of threat modeling and adversary tactics, this behavior corresponds to MITRE ATT&CK techniques related to Supply Chain Compromise, specifically the manipulation of build or CI/CD pipelines to introduce malicious code. The attack vector leverages trusted administrative interfaces within the development workflow, making it difficult for automated security monitoring systems to distinguish between legitimate developer actions and malicious exploitation attempts without deep contextual analysis.
To mitigate this risk, organizations must immediately upgrade Renovate to version 44.61.3 or later where the rebase logic has been corrected to respect minimum release age constraints regardless of how the update is triggered. In environments where upgrading is not instantly feasible, administrators should implement strict access controls on who can trigger PR rebases and retries, limiting these actions to trusted senior developers only. Additionally, integrating additional verification steps in the CI pipeline that independently validate dependency publication dates against known registries can provide a secondary layer of defense. Security teams should also audit recent pull requests for any signs of unusual dependency updates published shortly before their inclusion, ensuring that no malicious artifacts have already been propagated through this bypass mechanism.