CVE-2026-110868

High

Description

Renovate before 44.79.0 contains a server-side request forgery vulnerability that allows users to make the shared HTTP client request arbitrary internal URLs via extends presets or customDatasources. Attackers can point a preset at an instance metadata service endpoint to obtain AWS credentials or leak sensitive information through Renovate logs.

SeverityHigh

CVSS8.5

Exploit probability—

ProductRenovate

PublishedOct 14, 2026

First seenOct 14, 2026

Weakness typeCWE-918Server-side request forgery (SSRF)

How to fix

Update

renovatebot renovate44.79.0 or later
mend renovate-ce15.6.0 or later
mend renovate-ee-server15.6.0 or later
mend renovate-ee-worker15.6.0 or later
mend mend-renovate-ce helm chart15.6.0 or later
mend mend-renovate-enterprise-edition helm chart10.6.0 or later

Vendor advisories

github.com/renovatebot/renovate/security/advisories/GHSA-8rqp-w6vc-pf27

Affected products

Product	Affected versions	Fixed in
renovatebot renovate	v < 44.79.0	44.79.0
mend renovate-ce	v < 15.6.0	15.6.0
mend renovate-ee-server	v < 15.6.0	15.6.0
mend renovate-ee-worker	v < 15.6.0	15.6.0
mend mend-renovate-ce helm chart	v < 15.6.0	15.6.0
mend mend-renovate-enterprise-edition helm chart	v < 10.6.0	10.6.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.