CVE-2026-110868
8.5HighPublished 14 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- High impact on confidentiality
- Weakness
- CWE-918
Impact
Authenticated users can trigger server-side request forgery to steal cloud credentials (like AWS instance metadata) or leak internal network data into Renovate logs. They only need permission to configure Renovate via extends presets or customDatasources.
Root cause
The shared HTTP client allows requests to arbitrary internal and metadata URLs defined in user-controlled preset configurations or custom datasources.
Affected systems
Renovate versions before 44.79.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Fix & remediation
Upgrade Renovate to version 44.79.0 or later. If patching immediately is not possible, block outbound network access from the Renovate runner to internal endpoints and cloud metadata services (e.g., 169.254.169.254).
$ npm install -g renovate@latestAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Renovate before 44.79.0 contains a server-side request forgery vulnerability that allows users to make the shared HTTP client request arbitrary internal URLs via extends presets or customDatasources. Attackers can point a preset at an instance metadata service endpoint to obtain AWS credentials or leak sensitive information through Renovate logs.