CVE-2026-110867

Executive Summary

CVE-2026-110867 is an allowlist bypass vulnerability in Renovate versions before 44.60.1 (CVSS 8.5). A repository can set restricted environment variables by placing an env block inside a shared preset, and an attacker who controls an externally sourced preset can override variables such as PATH, LD_PRELOAD, NODE_OPTIONS, or GIT_SSL_CAINFO in child processes on self-hosted instances. Successful exploitation can lead to arbitrary code execution, credential theft, and compromise of the CI/CD pipeline.

Technical Analysis

Renovate is an automated dependency-update tool that runs as a bot, typically in CI/CD or a self-hosted service. Its configuration model supports presets — reusable configuration fragments that can be sourced from external repositories or registries. The product intends to restrict which environment variables a repository's configuration can set, because those variables are inherited by child processes Renovate spawns (for example, package managers, Git, or Node.js runtimes).

The flaw is an allowlist bypass (CWE-863, Incorrect Authorization). The allowlist enforcement does not correctly account for the env key when it appears inside a shared preset rather than in the top-level repository configuration. By nesting env within a preset, an attacker can set variables that should have been blocked.

The CVSS vector indicates network attack (AV:N), high attack complexity (AC:H), low privileges required (PR:L), no user interaction (UI:N), changed scope (S:C), and high confidentiality, integrity, and availability impact (C:H/I:H/A:H). The changed scope reflects that the vulnerable component (Renovate) affects resources beyond its security scope — specifically, the child processes it launches, which run with inherited environment variables. The high attack complexity is consistent with the precondition that an externally sourced preset must be under attacker control and must be consumed by the target.

The specific dangerous variables named in the description are:

• PATH — controls executable lookup, enabling binary planting/hijacking of the child process's command resolution.
• LD_PRELOAD — causes the dynamic linker to preload an attacker-supplied shared object into child processes on Linux, yielding code execution.
• NODE_OPTIONS — allows injecting Node.js runtime options such as --require, loading attacker code into any Node-based child process.
• GIT_SSL_CAINFO — redirects Git's TLS trust anchor, allowing man-in-the-middle interception of Git traffic and credential/secret exposure.

No public PoC, exploit code, or Nuclei template is available. Patch confidence is 0/4: no patch evidence was found in any tracked source. The NVD description states the fix is "before 44.60.1," meaning 44.60.1 is the intended fixed version, but no vendor advisory, commit, or release reference has been tracked to confirm it. Affected-version data and OSV package mappings are unavailable in the supplied intelligence.

Because the description is sparse on implementation detail, this report deliberately describes the vulnerability class and mechanism (an authorization/allowlist bypass permitting environment-variable injection through shared presets) and does not fabricate internal function names, file paths, or code constructs.

Exploitation Scenarios

The following attack chain is inferred from the vulnerability class and the NVD description; no public PoC is available, and no specific implementation details beyond the description are asserted.

1. Reconnaissance / target identification. The attacker identifies a self-hosted Renovate instance that consumes externally sourced presets. This requires knowledge of, or access to, a preset source that the target's Renovate configuration references (for example, a shared preset repository or registry the target pulls from). Self-hosted instances are the impacted deployment model per the description; hosted/SaaS deployments are not stated as affected.

2. Trigger of the flaw class. Presets are configuration fragments. The attacker places an env block inside a shared preset. Normally, restricted environment variables are blocked when set by a repository's own configuration; the allowlist is bypassed when the same key arrives via a preset. Because the preset is externally sourced and attacker-influenced, the restricted variables (PATH, LD_PRELOAD, NODE_OPTIONS, GIT_SSL_CAINFO) pass through the intended allowlist.

3. Payload / execution method (vulnerability-class level). Once the variables are accepted into configuration, they are inherited by the child processes Renovate spawns. Inheritance alone is the dangerous primitive: a poisoned LD_PRELOAD causes the dynamic linker to load an attacker-controlled shared object into those children; a poisoned NODE_OPTIONS causes Node-based children to load attacker code; a poisoned PATH redirects command resolution to an attacker-controlled binary; a poisoned GIT_SSL_CAINFO points Git at an attacker-controlled CA, enabling interception. The specific payloads and their delivery are not described in the source data and are not fabricated here.

4. Post-exploitation impact. Per the CVSS vector (S:C, C:H/I:H/A:H), the attacker can achieve code execution in child processes with high impact to confidentiality, integrity, and availability. Realistic outcomes in a dependency-update pipeline include theft of repository credentials and tokens present in the environment, tampering with dependency resolution (supply-chain injection), and lateral movement into connected CI/CD systems. The changed scope explicitly models impact extending beyond Renovate itself into the processes and systems it orchestrates.

Impact Assessment

The CVSS 3.1 base score is 8.5 (High), vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H.

• Attack Vector (Network): A remotely reachable component is involved; the attacker does not need physical or adjacent access.
• Attack Complexity (High): Exploitation requires a specific precondition — an externally sourced preset consumed by the target that the attacker controls or can influence.
• Privileges Required (Low): Low-level access is sufficient; the attacker does not need administrative rights on the target.
• User Interaction (None): No victim action is required beyond the target's normal pulling of presets.
• Scope (Changed): Impact extends beyond Renovate to the child processes it spawns and the systems/credentials those processes touch.
• Confidentiality / Integrity / Availability (High each): Code execution in child processes can expose secrets, alter build outputs, and disrupt the pipeline.

Blast radius: Self-hosted Renovate instances that consume externally sourced shared presets. In a CI/CD context, a compromise can propagate to source repositories, artifact registries, and downstream deployment environments, making this a supply-chain-relevant issue rather than a single-host compromise. EPSS is not yet scored by FIRST.org, so no exploitation-likelihood score is asserted. CISA KEV status is NO; there is no known exploit-in-the-wild evidence in the supplied data.

Detection Guidance

Detection focuses on the vulnerability class: unexpected environment-variable assignment through preset-sourced configuration, and process behavior consistent with poisoned LD_PRELOAD, NODE_OPTIONS, PATH, or GIT_SSL_CAINFO variables in Renovate-spawned children.

Sigma Rule

title: Suspicious Environment Variable Inheritance in Renovate Child Processes
id: 8f2a1c4e-renovate-env-bypass
status: experimental
description: Detects process creation by Renovate where child processes inherit dangerous environment variables (LD_PRELOAD, NODE_OPTIONS, GIT_SSL_CAINFO, PATH) consistent with CVE-2026-110867 preset env allowlist bypass.
author: valtersit.com
date: 2026-01-01
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/renovate'
      - '/node'
  selection_env:
    - Environment|contains: 'LD_PRELOAD='
    - Environment|contains: 'NODE_OPTIONS=--require'
    - Environment|contains: 'GIT_SSL_CAINFO='
  condition: selection_parent and selection_env
falsepositives:
  - Legitimate administrative configuration of hardening variables
level: high
tags:
  - attack.t1195
  - cve.2026.110867

YARA Rule

rule CVE_2026_110867_Renovate_Preset_Env
{
    meta:
        description = "Detects Renovate preset or configuration content that sets restricted environment variables via an env block in a shared preset (CVE-2026-110867)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "CVE-2026-110867"
        severity = "high"

    strings:
        $env = "env" ascii wide
        $p1  = "LD_PRELOAD" ascii wide
        $p2  = "NODE_OPTIONS" ascii wide
        $p3  = "GIT_SSL_CAINFO" ascii wide
        $p4  = "PATH" ascii wide

    condition:
        $env and 1 of ($p1, $p2, $p3, $p4)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-110867 Renovate preset env allowlist bypass - restricted env variable in preset response"; flow:established,to_client; http.response_body; content:"env"; nocase; content:"LD_PRELOAD"; nocase; distance:0; sid:2026110867; rev:1; reference:cve,2026-110867; classtype:attempted-admin;)

Elastic Detection

process where event.type == "start" and
  process.parent.name in ("renovate", "node") and
  process.env_vars like~ ("*LD_PRELOAD=*", "*NODE_OPTIONS=*", "*GIT_SSL_CAINFO=*")

Splunk SPL Query

index=os sourcetype=process_creation (ParentImage="*renovate*" OR ParentImage="*node*")
| search (CommandLine="*LD_PRELOAD*" OR CommandLine="*NODE_OPTIONS*" OR CommandLine="*GIT_SSL_CAINFO*" OR CommandLine="*env*")
| stats count values(CommandLine) as commands by host, ParentImage, User
| where count > 0

Wazuh OSSEC Rule

<group name="renovate,cve-2026-110867,">
  <rule id="110867" level="12">
    <decoded_as>json</decoded_as>
    <field name="parent_process">renovate|node</field>
    <field name="env" type="pcre2">(?i)(LD_PRELOAD|NODE_OPTIONS|GIT_SSL_CAINFO|PATH)=</field>
    <description>CVE-2026-110867: Renovate child process inherited restricted environment variable potentially bypassed via preset</description>
    <mitre>
      <id>T1195</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence was found from any tracked source. The NVD description states the fix is available before version 44.60.1, but no vendor advisory, commit, or release artifact has been tracked to confirm it. Treat all versions below 44.60.1 as potentially vulnerable, but do not rely on 44.60.1 as verified until the vendor advisory is published.

1. Immediate mitigations.

   • Restrict which external preset sources a self-hosted Renovate instance is allowed to consume. Disallow untrusted or externally controlled preset repositories/registries.
   • Run Renovate with a minimal, sanitized environment and drop or override dangerous variables (LD_PRELOAD, NODE_OPTIONS, GIT_SSL_CAINFO) before child processes are spawned, where the deployment model permits.
   • Isolate Renovate execution (containers, least-privilege service accounts, no access to production secrets) to limit the changed-scope impact.
   • Monitor for configuration containing env blocks inside shared presets as a temporary compensating control.

2. Patch / upgrade steps.

   • Monitor the Renovate project's official release notes and security advisory for the 44.60.1 release.
   • When a vendor-confirmed fix is available, upgrade to the fixed version and re-validate that restricted environment variables cannot be set through shared presets.
   • Pin Renovate to a trusted version and update only from official channels.

3. Long-term hardening.

   • Enforce integrity checks or signatures on all externally sourced presets.
   • Apply the principle of least privilege to the Renovate service account and any tokens it holds.
   • Add allowlist enforcement tests that cover nested configuration (presets) as part of CI, so authorization checks are verified for all configuration entry points.
   • Continuously monitor CVE-2026-110867 advisories and CISA KEV for status changes.

References

• NVD — CVE-2026-110867: https://nvd.nist.gov/vuln/detail/CVE-2026-110867
• Renovate project (official releases and security advisories) — verify 44.60.1 fix status there
• CWE-863 — Incorrect Authorization: https://cwe.mitre.org/data/definitions/863.html
• MITRE ATT&CK T1195 — Supply Chain Compromise: https://attack.mitre.org/techniques/T1195/
• CISA Known Exploited Vulnerabilities catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-110867 not currently listed)

Note: No public PoC, exploit code, Nuclei template, or known threat actor campaign has been identified for this CVE in the supplied data. EPSS has not yet scored this CVE.