CVE-2026-110867 in -renovate-ce helm chart
Summary
by MITRE • 10/15/2026
Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repositories to set restricted environment variables by placing env inside a shared preset. Attackers controlling an externally sourced preset can override variables like PATH, LD_PRELOAD, NODE_OPTIONS, or GIT_SSL_CAINFO in child processes on self-hosted instances.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in Renovate versions prior to 44.60.1 represents a critical security flaw within the configuration management system used for automated dependency updates. This issue stems from an insufficient validation mechanism when processing shared presets, which are reusable configuration blocks designed to standardize settings across multiple repositories. The core technical failure lies in how the application parses environment variable definitions nested within these preset structures. Specifically, the allowlist logic intended to restrict certain sensitive environment variables fails to account for configurations embedded inside a shared preset context. This oversight allows an attacker who controls or influences an externally sourced preset to inject restricted environment variables such as PATH, LD_PRELOAD, NODE_OPTIONS, and GIT_SSL_CAINFO into the execution environment of child processes running on self-hosted instances.
From a technical perspective, this vulnerability exploits the hierarchical nature of Renovate's configuration system. When a repository utilizes a shared preset, it inherits settings defined within that preset. The security boundary intended to prevent users from overriding critical system variables is bypassed because the validation routine does not recursively or deeply inspect environment variable assignments contained within these inherited configurations. Consequently, an adversary can craft a malicious preset that includes specific environment variable definitions. When this preset is applied by a victim repository on a self-hosted Renovate instance, the application processes the configuration without triggering the expected security checks, thereby injecting the attacker-controlled variables into the runtime environment of subsequent operations.
The operational impact of this vulnerability is severe, particularly in environments where Renovate runs with elevated privileges or accesses sensitive resources. By manipulating variables like LD_PRELOAD, an attacker could potentially achieve arbitrary code execution through library preloading techniques if the underlying system permits such modifications. Similarly, altering PATH can lead to command injection by prioritizing malicious executables over legitimate ones. Modifying NODE_OPTIONS allows for the insertion of harmful Node.js flags that can alter application behavior or expose internal data. Furthermore, tampering with GIT_SSL_CAINFO could facilitate man-in-the-middle attacks against version control operations, allowing an attacker to intercept and modify source code during updates. These actions compromise the integrity, confidentiality, and availability of the software supply chain managed by Renovate.
This flaw aligns with CWE-94 Improper Control of Generation of Code (Code Injection) as it allows for the injection of malicious configuration that alters execution paths. It also maps to MITRE ATT&CK technique T1059 Command and Scripting Interpreter, specifically through environment variable manipulation which can be used to influence subsequent command executions. Additionally, the aspect of bypassing security restrictions via inherited configurations relates to CWE-284 Improper Access Control. The vulnerability highlights a common risk in configuration management tools where inheritance mechanisms are not rigorously validated against malicious inputs from external sources.
To mitigate this risk, organizations must immediately upgrade Renovate to version 44.60.1 or later, which addresses the allowlist bypass by enforcing stricter validation on environment variables regardless of their location within the configuration hierarchy. Until an update is applied, administrators should restrict access to shared presets and avoid using externally sourced configurations in self-hosted instances that handle sensitive codebases. Implementing strict input validation for all preset sources and auditing existing configurations for unauthorized environment variable definitions are essential interim measures. Regular security audits of dependency management tools and adherence to the principle of least privilege when executing Renovate processes will further reduce the attack surface associated with this type of configuration-based vulnerability.