Vulnerability in Mend Renovate-Ce
CVE-2026-110865
Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repository users to evade the allowedHeaders restriction by placing hostRules headers inside shared presets. Attackers can supply internal or externally sourced presets with unvalidated hostRules[].headers to inject custom HTTP headers into requests Renovate sends to other hosts.
Published .
CVSS v3 metric
CVSS v3 base score 7.1 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
Weakness classification (CWE)
References
- github.com/renovatebot/renovate/security/advisories/GHSA-6j6f-fh7w-vvjr (vendor-advisory)
- www.vulncheck.com/advisories/renovate-before-44.60.1-http-header-allowlist-bypa… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-110865?
- CVE-2026-110865 is a high-severity vulnerability in Mend Renovate-Ce, classified under CWE-424. CVSS score: 7.1/10. Published 2026-10-14.
- How severe is CVE-2026-110865?
- High severity. CVSS v3 base score is 7.1 out of 10.