CVE-2026-110865

Executive Summary

CVE-2026-110865 is a critical allowlist bypass vulnerability in Renovate versions prior to 44.60.1, allowing repository users to circumvent the allowedHeaders restriction by embedding hostRules headers within shared presets. This flaw enables attackers to inject unvalidated custom HTTP headers into requests sent by Renovate to other hosts, potentially facilitating internal network reconnaissance, credential theft, or data exfiltration. Organizations using Renovate for automated dependency updates, particularly in multi-tenant or self-hosted environments, are at risk, with a CVSS score of 7.1 indicating high severity due to the potential for confidentiality impacts and scope changes.

Technical Analysis

Renovate is an open-source tool for automating dependency updates across repositories. The vulnerability arises from improper input validation (CWE-424) in how Renovate processes hostRules[].headers within shared presets. The allowedHeaders configuration is designed to restrict which custom HTTP headers can be sent to external hosts, preventing sensitive data leakage. However, attackers can bypass this restriction by placing hostRules headers inside shared presets, which are not subjected to the same validation. This allows the injection of arbitrary headers into HTTP requests that Renovate sends to other hosts, including internal services or third-party APIs.

The attack surface is the Renovate configuration parsing logic, specifically the handling of shared presets. When a repository uses a shared preset (e.g., from a remote source or an internal preset), the hostRules defined within it can include custom headers that are not validated against the allowedHeaders allowlist. Consequently, an attacker with the ability to influence the preset content (e.g., by contributing to a shared preset repository or compromising one) can inject headers such as Authorization, Cookie, or custom headers that may be used for authentication or routing. This bypasses the intended security control and can lead to unauthorized access to internal resources or information disclosure.

The CVSS vector (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N) indicates that the vulnerability is network-exploitable, requires high attack complexity (likely due to the need to influence preset content), low privileges (repository user), no user interaction, and results in a scope change (the vulnerable component impacts resources beyond its security scope). The confidentiality impact is high, as injected headers could expose sensitive data, while integrity impact is low, and availability impact is none.

Exploitation Scenarios

No public PoC is available; the attack chain is inferred from the vulnerability class. The exploitation involves the following steps:

1. Reconnaissance/Target Identification: The attacker identifies a target organization that uses Renovate for dependency updates, particularly in a configuration where shared presets are used. This could be a public repository with Renovate enabled, or a self-hosted Renovate instance. The attacker may look for repositories that reference external or shared presets, or have permissive preset configurations.

2. Triggering the Flaw: The attacker gains the ability to influence the content of a shared preset that the target's Renovate configuration references. This could be achieved by contributing to a public preset repository, compromising a preset source, or exploiting a misconfiguration where presets are fetched from an attacker-controlled location. Within the preset, the attacker defines hostRules with custom headers that are not listed in the allowedHeaders allowlist. For example, a preset might include a hostRules entry that adds an Authorization header with a token controlled by the attacker.

3. Payload/Execution Method: When Renovate processes the target's configuration, it merges the shared preset, including the malicious hostRules. Renovate then uses these hostRules when making HTTP requests to other hosts (e.g., package registries, internal APIs). The injected headers are sent without validation against allowedHeaders, effectively bypassing the restriction. The attacker's headers could be used to impersonate a user, access internal endpoints, or exfiltrate data to an attacker-controlled server.

4. Post-Exploitation Impact: The injected headers could allow the attacker to access internal services that trust headers for authentication (e.g., X-Forwarded-For, Authorization), leading to unauthorized data access or further lateral movement. Additionally, sensitive information from Renovate's requests (e.g., tokens, internal URLs) could be leaked to external hosts if headers are crafted to redirect or log requests. The scope change indicates that the vulnerability in Renovate can impact other components (e.g., internal APIs) that Renovate interacts with.

Impact Assessment

The business impact includes potential unauthorized access to internal systems, data breaches, and compliance violations. Affected systems are those using Renovate versions prior to 44.60.1, especially in environments where shared presets are used and internal hosts are reachable by Renovate. The blast radius can extend to any host that Renovate communicates with, as injected headers are sent to other hosts. The CVSS subscores highlight high confidentiality impact (C:H), low integrity impact (I:L), and no availability impact (A:N). The scope change (S:C) means that the vulnerable component (Renovate) can affect resources beyond its own security scope, such as internal APIs or third-party services. The attack complexity is high (AC:H) because the attacker must influence preset content, but once achieved, exploitation is straightforward.

Detection Guidance

Sigma Rule

title: Renovate Allowlist Bypass via Shared Presets
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2026-110865 by injecting hostRules headers in shared presets.
author: Threat Intelligence Team
date: 2026-07-15
logsource:
  product: renovate
  service: config
detection:
  selection:
    EventID: 1
    Image|endswith: 'renovate'
    CommandLine|contains: 'hostRules'
  condition: selection
falsepositives:
  - Legitimate configuration changes by administrators
level: high
tags:
  - attack.t1190
  - cve.2026.110865

YARA Rule

rule CVE_2026_110865_Renovate_Allowlist_Bypass
{
    meta:
        description = "Detects Renovate configuration files with hostRules headers in shared presets"
        author = "Threat Intelligence Team"
        date = "2026-07-15"
        reference = "CVE-2026-110865"
        severity = "high"
    strings:
        $s1 = "hostRules" ascii wide nocase
        $s2 = "headers" ascii wide nocase
        $s3 = "allowedHeaders" ascii wide nocase
    condition:
        all of ($s*) and filesize < 10KB
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-110865 Renovate Allowlist Bypass Attempt"; flow:to_server,established; content:"hostRules"; http_client_body; content:"headers"; http_client_body; distance:0; within:100; classtype:attempted-admin; sid:1000001; rev:1;)

Elastic Detection

sequence by process.entity_id with maxspan=5m
  [process where process.name == "renovate" and process.args : "*hostRules*"]
  [network where process.name == "renovate" and network.direction == "egress"]

Splunk SPL Query

index=renovate_logs sourcetype=renovate:config
| search "hostRules" AND "headers"
| table _time, host, user, config_file, hostRules
| sort - _time

Wazuh OSSEC Rule

<rule id="100100" level="12">
  <decoded_as>json</decoded_as>
  <field name="event_type">renovate</field>
  <field name="config">hostRules</field>
  <field name="config">headers</field>
  <description>CVE-2026-110865: Renovate allowlist bypass attempt detected</description>
  <mitre>
    <id>T1190</id>
  </mitre>
</rule>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate Mitigations:

   • Disable the use of shared presets from untrusted sources.
   • Restrict Renovate's network access to only necessary hosts using firewall rules or network policies.
   • Audit existing Renovate configurations for any unauthorized hostRules entries, especially within shared presets.
   • Implement strict allowlisting for preset sources and require code review for any changes to Renovate configurations.

2. Patch/Upgrade Steps:

   • Upgrade Renovate to version 44.60.1 or later as soon as a patch is available. Monitor the Renovate GitHub repository and security advisories for the official fix.
   • Since no patch is currently available, consider temporarily disabling Renovate or limiting its functionality until a fix is released.

3. Long-term Hardening:

   • Enforce the principle of least privilege for Renovate's execution environment.
   • Regularly review and update allowedHeaders configurations to ensure they are restrictive.
   • Implement network segmentation to limit Renovate's ability to reach sensitive internal hosts.
   • Use signed presets or internal preset repositories with strict access controls.
   • Conduct security training for developers on the risks of using untrusted presets.

References

• NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-110865
• Renovate GitHub Repository: https://github.com/renovatebot/renovate
• Renovate Security Advisories: https://github.com/renovatebot/renovate/security/advisories
• CWE-424: Improper Protection of Alternate Path: https://cwe.mitre.org/data/definitions/424.html
• CVSS v3.1 Specification: https://www.first.org/cvss/v3.1/specification-document
• No known threat actor campaigns or exploit-in-the-wild evidence at this time.