CVE-2026-110866
Medium
Description
Renovate before 44.61.3 contains a protection mechanism bypass vulnerability that allows minimumReleaseAge checks to be skipped when a user requests a PR rebase via the rebase/retry checkbox. Attackers who publish a malicious dependency version can have it pushed into the PR and run in CI before the required release age elapses.
SeverityMedium
CVSS4.7
Exploit probability—
ProductRenovate
PublishedOct 14, 2026
First seenOct 14, 2026
Weakness typeCWE-693CWE-693
How to fix
Update
- renovatebot renovate44.61.3 or later
- mend renovate-ce15.5.0 or later
- mend renovate-ee-server15.5.0 or later
- mend renovate-ee-worker15.5.0 or later
- mend mend-renovate-ce helm chart15.5.0 or later
- mend mend-renovate-enterprise-edition helm chart10.5.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| renovatebot renovate | v < 44.61.3 | 44.61.3 |
| mend renovate-ce | v < 15.5.0 | 15.5.0 |
| mend renovate-ee-server | v < 15.5.0 | 15.5.0 |
| mend renovate-ee-worker | v < 15.5.0 | 15.5.0 |
| mend mend-renovate-ce helm chart | v < 15.5.0 | 15.5.0 |
| mend mend-renovate-enterprise-edition helm chart | v < 10.5.0 | 10.5.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.