Renovate before 44.60.1 HTTP Header Allowlist Bypass via Shared Presets

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Oct 14, 2026 · NIST NVD

   Detected

   Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repository users to evade the allowedHeaders restriction by placing hostRules headers inside shared presets. Attackers can supply internal or externally sourced presets with unvalidated hostRules[].headers to inject custom HTTP headers into requests Renovate sends to other hosts.

Affected

• vendor mend mend-renovate-ce helm chartversion unspecified
• vendor mend mend-renovate-enterprise-edition helm chartversion unspecified
• vendor mend renovate-ceversion unspecified
• vendor mend renovate-ee-serverversion unspecified
• vendor mend renovate-ee-workerversion unspecified
• vendor renovatebot renovateversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-110865

  Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repository users to evade the allowedHeaders restriction by placing hostRules headers inside shared presets. Attackers can supply internal or externally sourced presets with unvalidated hostRules[].hea

  cve.org
• FIRST EPSSExploitation probabilityCVE-2026-110865

  30-day exploitation probability 0.2%

  first.org
• NIST NVDVulnerability recordCVE-2026-110865

  Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repository users to evade the allowedHeaders restriction by placing hostRules headers inside shared presets. Attackers can supply internal or externally sourced presets with unvalidated hostRules[].hea

  nvd.nist.gov

References

• Reference · github.com
• Reference · vulncheck.com