[ CVE-2026-110865 · Published 14 Oct 2026 ]
Vulnerability in renovatebot renovate
CVSS 7.1
EPSS <1%No fix listed yet
[ Description ]Official description
Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repository users to evade the allowedHeaders restriction by placing hostRules headers inside shared presets. Attackers can supply internal or externally sourced presets with unvalidated hostRules[].headers to inject custom HTTP headers into requests Renovate sends to other hosts.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.