{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-110865", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-10-14T22:18:33.239Z", "datePublished": "2026-10-14T22:52:52.525Z", "dateUpdated": "2026-10-26T15:22:16.486Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-14T22:52:52.525Z"}, "datePublic": "2026-09-29T00:00:00.000Z", "title": "Renovate before 44.60.1 HTTP Header Allowlist Bypass via Shared Presets", "descriptions": [{"lang": "en", "value": "Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repository users to evade the allowedHeaders restriction by placing hostRules headers inside shared presets. Attackers can supply internal or externally sourced presets with unvalidated hostRules[].headers to inject custom HTTP headers into requests Renovate sends to other hosts."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Protection of Alternate Path", "cweId": "CWE-424", "type": "CWE"}]}], "affected": [{"vendor": "renovatebot", "product": "renovate", "defaultStatus": "unaffected", "packageURL": "pkg:npm/renovate", "versions": [{"version": "0", "status": "affected", "versionType": "semver", "lessThan": "44.60.1"}]}, {"vendor": "mend", "product": "renovate-ce", "defaultStatus": "unaffected", "versions": [{"version": "0", "status": "affected", "versionType": "semver", "lessThan": "15.5.0"}]}, {"vendor": "mend", "product": "renovate-ee-server", "defaultStatus": "unaffected", "versions": [{"version": "0", "status": "affected", "versionType": "semver", "lessThan": "15.5.0"}]}, {"vendor": "mend", "product": "renovate-ee-worker", "defaultStatus": "unaffected", "versions": [{"version": "0", "status": "affected", "versionType": "semver", "lessThan": "15.5.0"}]}, {"vendor": "mend", "product": "mend-renovate-ce helm chart", "defaultStatus": "unaffected", "versions": [{"version": "0", "status": "affected", "versionType": "semver", "lessThan": "15.5.0"}]}, {"vendor": "mend", "product": "mend-renovate-enterprise-edition helm chart", "defaultStatus": "unaffected", "versions": [{"version": "0", "status": "affected", "versionType": "semver", "lessThan": "10.5.0"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N", "attackVector": "NETWORK", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH"}}], "references": [{"url": "https://github.com/renovatebot/renovate/security/advisories/GHSA-6j6f-fh7w-vvjr", "tags": ["vendor-advisory"], "name": "GitHub Security Advisory (GHSA-6j6f-fh7w-vvjr)"}, {"name": "VulnCheck Advisory: Renovate before 44.60.1 HTTP Header Allowlist Bypass via Shared Presets", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/renovate-before-44.60.1-http-header-allowlist-bypass-via-shared-presets"}], "credits": [{"lang": "en", "value": "jamietanna", "type": "reporter"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-26T15:22:04.979008Z", "id": "CVE-2026-110865", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-26T15:22:16.486Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-110865", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-26T15:22:04.979008Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-26T15:22:12.810Z"}}], "cna": {"title": "Renovate before 44.60.1 HTTP Header Allowlist Bypass via Shared Presets", "credits": [{"lang": "en", "type": "reporter", "value": "jamietanna"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "renovatebot", "product": "renovate", "versions": [{"status": "affected", "version": "0", "lessThan": "44.60.1", "versionType": "semver"}], "packageURL": "pkg:npm/renovate", "defaultStatus": "unaffected"}, {"vendor": "mend", "product": "renovate-ce", "versions": [{"status": "affected", "version": "0", "lessThan": "15.5.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "mend", "product": "renovate-ee-server", "versions": [{"status": "affected", "version": "0", "lessThan": "15.5.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "mend", "product": "renovate-ee-worker", "versions": [{"status": "affected", "version": "0", "lessThan": "15.5.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "mend", "product": "mend-renovate-ce helm chart", "versions": [{"status": "affected", "version": "0", "lessThan": "15.5.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "mend", "product": "mend-renovate-enterprise-edition helm chart", "versions": [{"status": "affected", "version": "0", "lessThan": "10.5.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "datePublic": "2026-09-29T00:00:00.000Z", "references": [{"url": "https://github.com/renovatebot/renovate/security/advisories/GHSA-6j6f-fh7w-vvjr", "name": "GitHub Security Advisory (GHSA-6j6f-fh7w-vvjr)", "tags": ["vendor-advisory"]}, {"url": "https://www.vulncheck.com/advisories/renovate-before-44.60.1-http-header-allowlist-bypass-via-shared-presets", "name": "VulnCheck Advisory: Renovate before 44.60.1 HTTP Header Allowlist Bypass via Shared Presets", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repository users to evade the allowedHeaders restriction by placing hostRules headers inside shared presets. Attackers can supply internal or externally sourced presets with unvalidated hostRules[].headers to inject custom HTTP headers into requests Renovate sends to other hosts."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-424", "description": "Improper Protection of Alternate Path"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-14T22:52:52.525Z"}}}, "cveMetadata": {"cveId": "CVE-2026-110865", "state": "PUBLISHED", "dateUpdated": "2026-10-26T15:22:16.486Z", "dateReserved": "2026-10-14T22:18:33.239Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-10-14T22:52:52.525Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:npm/renovate", "product": "renovate", "vendor": "renovatebot", "versions": [{"lessThan": "44.60.1", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "renovate-ce", "vendor": "mend", "versions": [{"lessThan": "15.5.0", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "renovate-ee-server", "vendor": "mend", "versions": [{"lessThan": "15.5.0", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "renovate-ee-worker", "vendor": "mend", "versions": [{"lessThan": "15.5.0", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "mend-renovate-ce helm chart", "vendor": "mend", "versions": [{"lessThan": "15.5.0", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "mend-renovate-enterprise-edition helm chart", "vendor": "mend", "versions": [{"lessThan": "10.5.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repository users to evade the allowedHeaders restriction by placing hostRules headers inside shared presets. Attackers can supply internal or externally sourced presets with unvalidated hostRules[].headers to inject custom HTTP headers into requests Renovate sends to other hosts."}], "id": "CVE-2026-110865", "lastModified": "2026-10-26T16:17:11.850", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 4.7, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-110865", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-26T15:22:04.979008Z", "version": "2.0.3"}}]}, "published": "2026-10-14T23:17:28.110", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/renovatebot/renovate/security/advisories/GHSA-6j6f-fh7w-vvjr"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/renovate-before-44.60.1-http-header-allowlist-bypass-via-shared-presets"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-424"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "renovate: Renovate: HTTP header injection via shared configuration presets", "id": "2552980", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2552980"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N", "status": "draft"}, "cwe": "CWE-15", "details": ["Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repository users to evade the allowedHeaders restriction by placing hostRules headers inside shared presets. Attackers can supply internal or externally sourced presets with unvalidated hostRules[].headers to inject custom HTTP headers into requests Renovate sends to other hosts.", "A flaw was found in Renovate. This vulnerability allows an authenticated repository user to bypass HTTP (Hypertext Transfer Protocol) header restrictions by specifying custom headers within shared configuration presets. By injecting arbitrary headers into outbound requests sent by Renovate, an attacker could potentially expose sensitive information or manipulate communications with remote services."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-110865", "public_date": "2026-10-14T22:52:52Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-110865\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-110865\nhttps://github.com/renovatebot/renovate/security/advisories/GHSA-6j6f-fh7w-vvjr\nhttps://www.vulncheck.com/advisories/renovate-before-44.60.1-http-header-allowlist-bypass-via-shared-presets"], "statement": "An IMPORTANT severity flaw was found in Renovate, which Red Hat ships in the Konflux mintmaker-renovate-image container image. When Renovate sends HTTP requests to external services, it restricts the headers that may be included through an allowlist (allowedHeaders). An authenticated repository user could evade this restriction by placing hostRules headers inside shared configuration presets, including internal or externally sourced presets, because hostRules[].headers supplied via presets were not validated against the allowlist. This allowed an attacker to inject arbitrary HTTP headers into outbound requests Renovate sends to other hosts, potentially exposing sensitive information such as credentials to unintended recipients or manipulating communication with remote services. The Konflux offering is affected, and a fix is being pursued through the delegated resolution for the mintmaker-renovate-image component. Red Hat rates this issue CVSS 7.1 (IMPORTANT), matching the CVE.org severity, so there is no difference from the upstream assessment.", "threat_severity": "Important"}