CVE-2026-110868

Executive Summary

CVE-2026-110868 is a server-side request forgery (SSRF) vulnerability in Renovate, the widely deployed automated dependency-update bot, affecting versions before 44.79.0. A user able to influence configuration (via extends presets or customDatasources) can coerce the shared HTTP client into requesting arbitrary internal URLs, including cloud instance metadata endpoints. Successful exploitation can expose cloud credentials — notably AWS IAM keys — or leak sensitive data through Renovate logs, resulting in a high-impact confidentiality breach across the CI/CD supply chain.

Technical Analysis

The vulnerability is classified as CWE-918 (Server-Side Request Forgery). Renovate resolves external configuration sources at runtime. Two configuration surfaces are named in the description:

• extends presets — Renovate can inherit configuration from a named preset, and the resolver fetches the referenced resource.
• customDatasources — user-defined data sources that Renovate queries to discover new versions.

Both surfaces are processed through a shared HTTP client. Because that client does not adequately restrict destination hosts (no effective blocklist/allowlist enforced for internal or link-local address ranges), a user with the ability to supply or modify Renovate configuration can cause the bot to issue HTTP requests to arbitrary URLs, including addresses that should be unreachable from a properly isolated runner.

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N summarizes the risk profile:

• AV:N — the vulnerable component is reachable over a network using standard protocols.
• AC:L — no specialized conditions are required; configuration-driven request resolution is a normal code path.
• PR:L — the attacker requires low privileges, i.e., the ability to contribute configuration (for example, editing a repository's Renovate config).
• UI:N — no user interaction is needed beyond normal Renovate execution.
• S:C — scope change: the HTTP client is a shared component, so impact extends beyond the directly affected configuration scope.
• C:H — confidentiality impact is high; the primary objective is credential and secret exfiltration.
• I:L — limited integrity impact; the description does not establish arbitrary write capability.
• A:N — no availability impact is described.

The core mechanism is straightforward SSRF: attacker-controlled input determines the request target, the shared client performs the fetch with the runner's network identity and privileges, and the response (or error output) is surfaced to the attacker directly or via logs. No public PoC, exploit code, or Nuclei template exists for this CVE, and there is no evidence of exploitation in the wild.

Note on specificity: The NVD description names only the two configuration surfaces (extends presets and customDatasources), the shared HTTP client, instance metadata endpoints, AWS credentials, and Renovate logs. No function names, class names, internal API paths, or parameter names beyond these are provided. The analysis is therefore confined to the vulnerability class and the mechanism explicitly described.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred strictly from the SSRF vulnerability class and the details in the NVD description.

1. Reconnaissance / target identification. The attacker identifies an environment where Renovate runs automatically (self-hosted or hosted), and where the attacker holds low-level privileges sufficient to influence Renovate configuration — for example, the permission to open a pull request or push a branch that alters the repository's Renovate configuration.

2. Triggering the flaw class. The attacker supplies a malicious configuration that abuses one of the two named surfaces: an extends preset pointing at an internal URL, or a customDatasources entry whose target resolves to an internal address. When Renovate processes the configuration, the shared HTTP client is directed to that URL rather than to a legitimate external source.

3. Payload / execution method (vulnerability-class level). The attacker points the preset or data source at an instance metadata service endpoint (e.g., the cloud provider's link-local metadata address). The shared HTTP client issues the request from the runner's network context. Because the response or resulting error text is processed by Renovate, the returned metadata — which can include AWS credentials — becomes accessible to the attacker, either directly returned or disclosed in Renovate logs.

4. Post-exploitation impact. Possession of instance metadata credentials (for example, AWS IAM role credentials) allows the attacker to pivot into the cloud account with the privileges attached to the Renovate runner's role. This can enable further lateral movement, access to source code, secrets, or other cloud resources, and persistence via the compromised identity. Alternatively, even without credential theft, internal URLs queried by the shared HTTP client may return sensitive service data that is leaked through logs.

Impact Assessment

The business impact is concentrated in the CI/CD and software supply chain. Renovate frequently runs with elevated, automated privilege and often holds tokens capable of reading source repositories and opening pull requests at scale. A compromised Renovate runner therefore represents a high-value pivot point.

• Confidentiality (High): The stated goal is exfiltration of AWS credentials from the instance metadata service and leakage of sensitive information through logs. Credentials obtained this way grant the attacker the runner's cloud identity.
• Integrity (Low): The description establishes no arbitrary modification capability; integrity impact is limited to whatever the stolen cloud identity subsequently permits.
• Availability (None): No denial-of-service behavior is described.
• Scope (Changed): The shared HTTP client is a common component, so a single malicious configuration can affect resources beyond the originating repository or job, consistent with the S:C metric.

Blast radius: Any organization running Renovate before 44.79.0 where untrusted or semi-trusted users can alter Renovate configuration — multi-tenant hosted services, open-source repositories accepting external configuration contributions, and internal self-hosted installations with broad contributor access. Cloud-hosted runners are the highest-priority exposure because of the metadata endpoint reachability. Because the CVSS base score is 8.5 (High) with a low privilege requirement and no user interaction, this should be treated as a priority remediation item despite the absence of known exploitation.

Detection Guidance

Sigma Rule

title: Renovate SSRF via extends Preset or customDatasources to Metadata Endpoint
id: 8f3c1a90-2b7e-4d6a-9c11-renovate110868
status: experimental
description: Detects Renovate processes making HTTP requests to cloud instance metadata or internal RFC1918/link-local addresses, indicating SSRF (CVE-2026-110868).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-110868
author: Threat Intelligence
logsource:
  category: process_creation
  product: linux
detection:
  selection_proc:
    Image|endswith:
      - '/node'
      - '/renovate'
  selection_args:
    CommandLine|contains:
      - 'renovate'
      - 'extends'
      - 'customDatasources'
  selection_meta:
    CommandLine|contains:
      - '169.254.169.254'
      - 'metadata.google.internal'
      - 'fd00:ec2::254'
  condition: selection_proc and selection_args and selection_meta
falsepositives:
  - Legitimate administrative scripts querying metadata endpoints
level: high
tags:
  - attack.t1190
  - cve.2026.110868

YARA Rule

rule CVE_2026_110868_Renovate_SSRF_Indicators
{
    meta:
        description = "Detects Renovate configuration artifacts attempting SSRF to instance metadata endpoints (CVE-2026-110868)"
        author = "Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-110868"
        date = "2026-01-01"
        severity = "high"

    strings:
        $extends = "extends" ascii nocase
        $cds = "customDatasources" ascii nocase
        $meta1 = "169.254.169.254" ascii
        $meta2 = "metadata.google.internal" ascii nocase
        $meta3 = "fd00:ec2::254" ascii
        $meta4 = "latest/meta-data" ascii

    condition:
        (uint32(0) == 0x646F636A) or
        (
            ($extends or $cds) and
            any of ($meta*)
        )
}

Suricata IDS Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-110868 Renovate SSRF Attempt to Instance Metadata Endpoint"; flow:established,to_server; http.host; content:"169.254.169.254"; http.uri; content:"meta-data"; reference:cve,2026-110868; classtype:attempted-recon; sid:2026110868; rev:1;)
alert http $HOME_NET any -> $HOME_NET any (msg:"CVE-2026-110868 Renovate SSRF Internal URL Access"; flow:established,to_server; http.user_agent; content:"Renovate"; http.host; pcre:"/(^127\.|^10\.|^192\.168\.|^172\.(1[6-9]|2[0-9]|3[01])\.|^169\.254\.)/"; reference:cve,2026-110868; classtype:attempted-recon; sid:2026110869; rev:1;)

Elastic Detection

process where event.type == "start" and
  process.name in ("node", "renovate") and
  process.args : "renovate" and
  (
    process.command_line : "*169.254.169.254*" or
    process.command_line : "*metadata.google.internal*" or
    process.command_line : "*latest/meta-data*" or
    process.command_line : "*customDatasources*"
  )

Splunk SPL Query

index=proxy OR index=web
(uri_path="*meta-data*" OR dest_host="169.254.169.254" OR dest_host="metadata.google.internal")
| search (http_user_agent="*Renovate*" OR referer="*renovate*" OR src_process="node")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, dest_host, uri_path, http_user_agent
| where count > 0
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="renovate,ssrf,web,">
  <rule id="110868" level="12">
    <decoded_as>json</decoded_as>
    <field name="process.name">renovate|node</field>
    <match>169.254.169.254|metadata.google.internal|latest/meta-data|customDatasources|extends</match>
    <description>CVE-2026-110868: Possible Renovate SSRF to instance metadata or internal URL.</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_110868,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence was identified from any tracked source. The NVD description references a version boundary (before 44.79.0), but there is no confirmed vendor advisory, commit, or release note in the provided data. Treat all environments on affected versions as unpatched until the vendor fix is independently verified.

1. Immediate mitigations

   • Restrict Renovate's ability to reach internal networks. Run Renovate in a network-isolated execution environment that cannot reach cloud instance metadata services or RFC1918/link-local ranges.
   • Enforce egress filtering: block link-local metadata range 169.254.169.254 (and IPv6 equivalents) at the network layer, and permit only required external package-registry and preset hosts in an allowlist.
   • Where the platform supports it, enforce IMDSv2 with a hop limit of 1 and require session tokens to reduce the usefulness of a successful SSRF fetch.
   • Restrict who can modify Renovate configuration (extends presets, customDatasources) within repositories and on the Renovate service itself; treat config changes as privileged operations.
   • Reduce the privileges of the runner's cloud identity to least privilege and short-lived credentials.

2. Patch / upgrade steps

   • Monitor the Renovate project's releases and advisories. When a vendor-confirmed fix for CVE-2026-110868 is published, upgrade to the fixed release (reported boundary: 44.79.0) and validate the shared HTTP client enforces destination restrictions.
   • Verify the fix by testing that a malicious extends preset or customDatasources entry targeting an internal URL is rejected before deployment.

3. Long-term hardening

   • Implement SSRF protections at the HTTP client layer where possible: allowlisting permitted preset/data-source hosts and blocking private, loopback, and link-local address space, including after DNS resolution (defense against DNS rebinding).
   • Apply network segmentation so dependency-update bots operate in a dedicated, least-privileged segment.
   • Log and alert on Renovate requests to unusual or internal destinations, and review Renovate logs for leaked metadata responses.
   • Adopt a supply-chain security review that treats automated dependency-update infrastructure as a high-value asset requiring the same hardening as production systems.

References

• NVD — CVE-2026-110868: https://nvd.nist.gov/vuln/detail/CVE-2026-110868
• MITRE CWE-918 (Server-Side Request Forgery): https://cwe.mitre.org/data/definitions/918.html
• Renovate project (configuration: presets / customDatasources): https://docs.renovatebot.com/
• CISA Known Exploited Vulnerabilities Catalog (not currently listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-110868 in the provided data. No public PoC, exploit code, or Nuclei template is known at the time of writing. EPSS has not been scored by FIRST.org.