CVE-2026-110868
Renovate before 44.79.0 SSRF via HTTP Preset URLs and customDatasources
Published Oct 14, 2026 · updated Oct 14, 2026 · renovatebot renovate
Renovate before 44.79.0 contains a server-side request forgery vulnerability that allows users to make the shared HTTP client request arbitrary internal URLs via extends presets or customDatasources. Attackers can point a preset at an instance metadata service endpoint to obtain AWS credentials or leak sensitive information through Renovate logs.
Timeline
Detection, updates, and resolution for this record.
Oct 14, 2026 · NIST NVD
Detected
Renovate before 44.79.0 contains a server-side request forgery vulnerability that allows users to make the shared HTTP client request arbitrary internal URLs via extends presets or customDatasources. Attackers can point a preset at an instance metadata service endpoint to obtain AWS credentials or leak sensitive information through Renovate logs.
Affected
- vendor mend mend-renovate-ce helm chartversion unspecified
- vendor mend mend-renovate-enterprise-edition helm chartversion unspecified
- vendor mend renovate-ceversion unspecified
- vendor mend renovate-ee-serverversion unspecified
- vendor mend renovate-ee-workerversion unspecified
- vendor renovatebot renovateversion unspecified
Sources
- CVE.orgCVE-2026-110868
Renovate before 44.79.0 contains a server-side request forgery vulnerability that allows users to make the shared HTTP client request arbitrary internal URLs via extends presets or customDatasources. Attackers can point a preset at an instance metadata service endpoint to obtain
cve.org - NIST NVDCVE-2026-110868
Renovate before 44.79.0 contains a server-side request forgery vulnerability that allows users to make the shared HTTP client request arbitrary internal URLs via extends presets or customDatasources. Attackers can point a preset at an instance metadata service endpoint to obtain
nvd.nist.gov