CVE-2026-110866

Executive Summary

CVE-2026-110866 is a protection mechanism bypass in Renovate (an open-source dependency-update bot) affecting versions before 44.61.3. The vulnerability allows the minimumReleaseAge guard — a guard designed to delay adoption of newly published dependency versions — to be skipped when a user requests a PR rebase via the rebase/retry checkbox. An attacker who publishes a malicious dependency version can have it pulled into an open PR and executed in CI before the mandated release-age window elapses.

Technical Analysis

Renovate is a widely deployed automated dependency-update tool that runs inside CI/CD pipelines (GitHub Actions, GitLab CI, Jenkins, Bitbucket Pipelines, and self-hosted runners are all common deployment targets). A core defensive feature is minimumReleaseAge, which instructs Renovate to ignore dependency releases that have not yet existed for a configured period (for example, 3 or 7 days). The intent is to provide a quarantine window during which the community or maintainers can detect a malicious or broken release — the exact threat model of an npm/PyPI/"typosquat-with-malicious-postinstall" supply-chain attack.

The vulnerability is classified under CWE-693 (Protection Mechanism Failure). Per the NVD description, when a user (or an automated actor with the ability to interact with the PR) requests a rebase via the rebase/retry checkbox, Renovate re-evaluates the branch and can skip the minimumReleaseAge check. This means a version that would normally be held back for the quarantine period can be promoted into the PR and subsequently executed by CI.

The CVSS vector reflects this: AV:N (triggerable over the network), AC:L (no special conditions beyond normal operation), PR:N (attacker does not need a Renovate role), UI:R (a human must check the rebase/retry box), S:C (scope change — the vulnerable Renovate process affects downstream CI/PR artifacts), and I:L/C:N/A:N (limited integrity impact: dependency content can be altered/executed without confidentiality or availability impact). Score: 4.7 (Medium).

The specific code path that fails to reapply the age check on rebase is not enumerated in the NVD text; per accuracy rules, no function or parameter names beyond minimumReleaseAge and rebase/retry are asserted here. What is established: the bypass is in the rebase/retry handling logic, not in the age comparison itself.

Exploitation Scenarios

No public PoC is available; the chain below is inferred from the vulnerability class and the NVD description.

1. Reconnaissance. The attacker identifies a target repository that uses Renovate with a minimumReleaseAge policy. This is trivially observable from public Renovate PRs, renovate.json config, or PR comments authored by the renovate[bot] account. The attacker also determines which package manager ecosystem (npm, pip, Maven, etc.) the target consumes.

2. Malicious publication. The attacker publishes a new version of a dependency (either a directly consumed package, or a compromised maintainer account publishing to an existing popular package). This version contains the malicious payload. Because it was just published, it is inside the minimumReleaseAge window.

3. Triggering the bypass. The minimumReleaseAge guard would normally prevent Renovate from opening or updating a PR to this version. The attacker (or an unwitting maintainer/contributor) checks the rebase/retry checkbox on an existing Renovate PR — a routine action in normal workflows. Renovate's rebase handling re-evaluates the branch and, per the flaw, fails to re-apply the minimumReleaseAge gate. The freshly published malicious version is now present in the PR.

4. Execution in CI. The PR triggers the target's CI pipeline. Any install step (npm install, pip install, mvn install, lockfile regeneration, or a post-install hook) executes the malicious package's code in the CI environment, potentially exposing secrets available to the runner and enabling lateral movement into the repository or its release process.

The scope change in the CVSS vector (S:C) captures that the vulnerable Renovate component affects the integrity of the downstream CI system and the produced artifacts, not just Renovate itself.

Impact Assessment

Business impact is supply-chain centric: unauthorized code can be introduced into a build pipeline before the intended quarantine period expires, defeating the primary mitigation organizations rely on for fast-moving ecosystems like npm. Pipelines frequently hold long-lived credentials — registry tokens, cloud deploy keys, signing keys — making CI execution a high-value objective even though the direct CVSS I-subscore is Low. Any organization running Renovate < 44.61.3 with a non-zero minimumReleaseAge and a CI that executes installs on PRs is in scope. Blast radius depends on the number of repos using the shared Renovate configuration and the privilege level of the CI runner identity; a single compromised runner can affect multiple repositories. Exploitation requires user interaction (UI:R) and no KEV listing or public exploit exists, so real-world exploitation is currently assessed as low-likelihood but high-consequence. EPSS is 0.00209 (10.4th percentile), consistent with a low-activity, recently disclosed issue with no weaponized exploit in the wild.

Detection Guidance

Sigma Rule

title: Renovate minimumReleaseAge Bypass via Rebase/Retry Checkbox
id: 9c1f5e3a-7b2d-4a8e-9c1a-renovate-110866
status: experimental
description: Detects Renovate bot running with minimumReleaseAge configured and processing a rebase/retry request, potentially bypassing the release-age gate and pulling a newly published dependency into CI.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-110866
logsource:
  category: process_creation
  product: linux
detection:
  selection_image:
    Image|endswith:
      - '/renovate'
      - '/renovate.js'
      - 'node'
  selection_args:
    CommandLine|contains:
      - 'renovate'
      - 'minimumReleaseAge'
      - 'rebase'
  condition: selection_image and selection_args
falsepositives:
  - Legitimate scheduled Renovate runs on unpatched installations
level: medium
tags:
  - attack.t1195
  - cve.2026.110866

YARA Rule

rule CVE_2026_110866_Renovate_MinReleaseAge_Bypass
{
    meta:
        description = "Detects Renovate source/config referencing minimumReleaseAge and rebase/retry handling that may be affected by CVE-2026-110866"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-110866"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $a = "minimumReleaseAge" ascii wide nocase
        $b = "rebase/retry" ascii wide nocase
        $c = "rebase" ascii wide nocase
        $d = "renovate" ascii wide nocase

    condition:
        uint32(0) != 0x7f454c46 and
        (
            ($a and $b) or
            ($d and $a and $c)
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-110866 Renovate minimumReleaseAge bypass via rebase/retry interaction"; flow:to_server,established; http.method; content:"POST"; http.header; content:"renovate"; nocase; http.request_body; content:"rebase"; nocase; http.request_body; content:"retry"; nocase; reference:cve,2026-110866; classtype:attempted-user; sid:2026110866; rev:1;)

Elastic Detection

process where event.type == "start" and
  process.name in ("renovate", "node", "npm") and
  process.command_line : ("*minimumReleaseAge*" or "*rebase*") and
  process.command_line : "*renovate*"

Splunk SPL Query

index=ci OR index=github sourcetype=renovate OR sourcetype=github:audit
| search ("minimumReleaseAge" OR "rebase/retry" OR "rebase") AND ("renovate" OR "dependabot")
| where match(_raw, "(?i)rebase") AND match(_raw, "(?i)minimumReleaseAge")
| stats count min(_time) as first_seen max(_time) as last_seen by host, user, repo, pr_number
| sort - last_seen

Wazuh OSSEC Rule

<group name="renovate,supply_chain,cve-2026-110866,">
  <rule id="1108660" level="10">
    <decoded_as>json</decoded_as>
    <field name="process.command_line">minimumReleaseAge</field>
    <field name="process.command_line">rebase</field>
    <description>CVE-2026-110866: Possible Renovate minimumReleaseAge bypass via rebase/retry request</description>
    <mitre>
      <id>T1195</id>
    </mitre>
  </rule>
  <rule id="1108661" level="8">
    <decoded_as>json</decoded_as>
    <field name="event.category">dependency_update</field>
    <field name="pr.labels">rebase</field>
    <description>Renovate processed a rebase request on a PR gated by minimumReleaseAge</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch, not independently confirmed).

1. Immediate mitigations

   • Upgrade Renovate to 44.61.3 or later; the fix is claimed in that release by OSV. Verify the release in the authoritative Renovate repository before relying on it.
   • If upgrade cannot be performed immediately, disable or restrict the minimumReleaseAge workflow as a compensating control, and manually review every Renovate PR that introduces a version newer than the configured age window.
   • Restrict who can trigger rebase/retry on Renovate PRs (branch protection, PR comment permissions, and CODEOWNERS review) to reduce the UI surface for step 3 of the attack chain.
   • Harden CI: run dependency-install steps with least-privilege tokens, require approval for workflows that install from untrusted registries, and avoid long-lived cloud credentials on PR-triggered jobs.

2. Patch / upgrade steps

   • Identify all Renovate deployments: self-hosted runners, GitHub Actions workflows, renovatebot/github-action, and hosted Renovate/ Mend Renovate app instances.
   • Pin the runner image or action to 44.61.3 (or later) rather than latest.
   • Re-run Renovate and confirm minimumReleaseAge is enforced for a newly published test package before re-enabling normal operation.

3. Long-term hardening

   • Enforce lockfile integrity and require lockfile review for any dependency version inside the quarantine window.
   • Alert on any Renovate PR that adds a package version with a publication timestamp newer than the configured minimumReleaseAge.
   • Treat CI runners as untrusted infrastructure: short-lived OIDC tokens, sandboxed install steps, and egress restrictions.
   • Continuously monitor the Renovate advisory feed and subscribe to OSV notifications for this package.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-110866
• CWE-693 Protection Mechanism Failure: https://cwe.mitre.org/data/definitions/693.html
• CISA Known Exploited Vulnerabilities catalog (not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• OSV (patch source referencing Renovate 44.61.3): https://osv.dev
• Renovate documentation — minimumReleaseAge configuration reference: https://docs.renovatebot.com/configuration-options/#minimumreleaseage

No known threat actor campaign or exploit-in-the-wild evidence is available at this time. CVE is not present in CISA KEV; EPSS 0.00209 (10.4th percentile); no public PoC or Nuclei template observed.